{"meta":{"site_url":"https://awesomerea.org","repository_url":"https://github.com/reacher-z/Awesome-REA","resource_count":1253,"independent_integration_count":85,"latest_review":"2026-11-06","verification_note":"Curated resource descriptions are reviewed against primary sources. The broader repository index is collected automatically.","source_index":{"available":true,"resource_count":3309,"scanned_count":3500,"excluded_count":191,"status":"published-selection","publication_schema_version":2,"published_at":"2026-10-20T10:49:31Z","full_export":"source-published.json","verification":"automated-readme-scan"},"paper_count":235},"topic_labels":{"reverse-engineering":{"en":"Reverse engineering","zh":"逆向工程"},"binary-analysis":{"en":"Binary analysis","zh":"二进制分析"},"decompiler":{"en":"Decompiler","zh":"反编译器"},"malware-analysis":{"en":"Malware analysis","zh":"恶意软件分析"},"disassembler":{"en":"Disassembler","zh":"反汇编器"},"decompilation":{"en":"Decompilation","zh":"反编译"},"deobfuscation":{"en":"Deobfuscation","zh":"去混淆"},"static-analysis":{"en":"Static analysis","zh":"静态分析"},"firmware-analysis":{"en":"Firmware analysis","zh":"固件分析"},"protocol-analysis":{"en":"Protocol analysis","zh":"协议分析"},"cybersecurity":{"en":"Cybersecurity","zh":"网络安全"},"mobile-security":{"en":"Mobile security","zh":"移动安全"},"apk-analysis":{"en":"APK analysis","zh":"APK 分析"},"android-security":{"en":"Android security","zh":"Android 安全"},"security-tools":{"en":"Security tools","zh":"安全工具"},"android-reverse-engineering":{"en":"Android reverse engineering","zh":"Android 逆向工程"},"penetration-testing":{"en":"Penetration testing","zh":"渗透测试"},"reverse-engineering-tools":{"en":"Reverse engineering tools","zh":"逆向工程工具"},"dynamic-analysis":{"en":"Dynamic analysis","zh":"动态分析"},"security-research":{"en":"Security research","zh":"安全研究"},"obfuscation":{"en":"Obfuscation","zh":"代码混淆"},"ai-agents":{"en":"AI agents","zh":"AI 智能体"},"mcp-server":{"en":"MCP server","zh":"MCP 服务"},"binary-diffing":{"en":"Binary diffing","zh":"二进制差异分析"},"bytecode":{"en":"Bytecode","zh":"字节码"},"cli":{"en":"CLI","zh":"命令行工具"},"emulator":{"en":"Emulator","zh":"模拟器"},"game":{"en":"Game","zh":"游戏"},"games":{"en":"Games","zh":"游戏"},"assembly":{"en":"Assembly","zh":"汇编"},"automation":{"en":"Automation","zh":"自动化"},"awesome-list":{"en":"Awesome list","zh":"精选资源列表"},"binary":{"en":"Binary","zh":"二进制"},"firmware":{"en":"Firmware","zh":"固件"},"firmware-tools":{"en":"Firmware tools","zh":"固件工具"},"vulnerability-research":{"en":"Vulnerability research","zh":"漏洞研究"},"debugger":{"en":"Debugger","zh":"调试器"},"malware-research":{"en":"Malware research","zh":"恶意软件研究"},"debugging":{"en":"Debugging","zh":"调试"},"modding":{"en":"Modding","zh":"模组制作"},"analysis":{"en":"Analysis","zh":"分析"},"ghidra-extension":{"en":"Ghidra extension","zh":"Ghidra 扩展"},"ai-agent":{"en":"AI agent","zh":"AI 智能体"},"iot":{"en":"IoT","zh":"物联网"},"cryptography":{"en":"Cryptography","zh":"密码学"},"forensics":{"en":"Forensics","zh":"取证"},"network-analysis":{"en":"Network analysis","zh":"网络分析"},"program-analysis":{"en":"Program analysis","zh":"程序分析"},"plugin":{"en":"Plugin","zh":"插件"},"network-security":{"en":"Network security","zh":"网络安全"},"developer-tools":{"en":"Developer tools","zh":"开发者工具"},"model-context-protocol":{"en":"Model Context Protocol","zh":"模型上下文协议"},"ios-security":{"en":"iOS security","zh":"iOS 安全"},"hooking":{"en":"Hooking","zh":"钩子技术"},"game-reversing":{"en":"Game reversing","zh":"游戏逆向"},"trainer":{"en":"Trainer","zh":"修改器"},"symbolic-execution":{"en":"Symbolic execution","zh":"符号执行"},"vulnerability-scanner":{"en":"Vulnerability scanner","zh":"漏洞扫描器"},"agent-skills":{"en":"Agent skills","zh":"智能体技能"},"fuzzing":{"en":"Fuzzing","zh":"模糊测试"},"exploit-development":{"en":"Exploit development","zh":"漏洞利用开发"},"instrumentation":{"en":"Instrumentation","zh":"插桩"},"security-audit":{"en":"Security audit","zh":"安全审计"},"unpacking":{"en":"Unpacking","zh":"脱壳"},"compiler":{"en":"Compiler","zh":"编译器"},"threat-intelligence":{"en":"Threat intelligence","zh":"威胁情报"},"tools":{"en":"Tools","zh":"工具"},"packet-analysis":{"en":"Packet analysis","zh":"数据包分析"},"embedded":{"en":"Embedded","zh":"嵌入式"},"bug-bounty":{"en":"Bug bounty","zh":"漏洞赏金"},"research":{"en":"Research","zh":"研究"},"framework":{"en":"Framework","zh":"框架"},"mobile":{"en":"Mobile","zh":"移动端"},"iot-security":{"en":"IoT security","zh":"物联网安全"},"game-decompilation":{"en":"Game decompilation","zh":"游戏反编译"},"artificial-intelligence":{"en":"Artificial intelligence","zh":"人工智能"},"machine-learning":{"en":"Machine learning","zh":"机器学习"},"deep-learning":{"en":"Deep learning","zh":"深度学习"},"llm":{"en":"LLM","zh":"大语言模型"},"llms":{"en":"LLMs","zh":"大语言模型"},"ai":{"en":"AI","zh":"人工智能"},"agent":{"en":"Agent","zh":"智能体"},"agents":{"en":"Agents","zh":"智能体"},"mcp-servers":{"en":"MCP servers","zh":"MCP 服务"},"mcp-tools":{"en":"MCP tools","zh":"MCP 工具"},"mcp":{"en":"MCP","zh":"MCP"},"browser":{"en":"Browser","zh":"浏览器"},"web":{"en":"Web","zh":"网站"},"website":{"en":"Website","zh":"网站"},"web-security":{"en":"Web security","zh":"网站安全"},"web-scraping":{"en":"Web scraping","zh":"网页抓取"},"scraping":{"en":"Scraping","zh":"数据抓取"},"network":{"en":"Network","zh":"网络"},"networking":{"en":"Networking","zh":"网络通信"},"protocol":{"en":"Protocol","zh":"协议"},"protocols":{"en":"Protocols","zh":"协议"},"packet-capture":{"en":"Packet capture","zh":"抓包"},"packet-sniffer":{"en":"Packet sniffer","zh":"数据包嗅探器"},"traffic-analysis":{"en":"Traffic analysis","zh":"流量分析"},"proxy":{"en":"Proxy","zh":"代理"},"http-proxy":{"en":"HTTP proxy","zh":"HTTP 代理"},"security":{"en":"Security","zh":"安全"},"hacking":{"en":"Hacking","zh":"黑客技术"},"pentesting":{"en":"Pentesting","zh":"渗透测试"},"ctf":{"en":"CTF","zh":"CTF 竞赛"},"ctf-tools":{"en":"CTF tools","zh":"CTF 工具"},"ctf-writeups":{"en":"CTF write-ups","zh":"CTF 题解"},"ctf-challenges":{"en":"CTF challenges","zh":"CTF 题目"},"cheatsheet":{"en":"Cheat sheet","zh":"速查表"},"cheat-sheet":{"en":"Cheat sheet","zh":"速查表"},"awesome":{"en":"Awesome","zh":"精选资源"},"awesome-lists":{"en":"Awesome lists","zh":"精选资源列表"},"list":{"en":"List","zh":"列表"},"collection":{"en":"Collection","zh":"资源合集"},"resources":{"en":"Resources","zh":"资源"},"learning":{"en":"Learning","zh":"学习资源"},"tutorial":{"en":"Tutorial","zh":"教程"},"tutorials":{"en":"Tutorials","zh":"教程"},"book":{"en":"Book","zh":"书籍"},"books":{"en":"Books","zh":"书籍"},"documentation":{"en":"Documentation","zh":"文档"},"education":{"en":"Education","zh":"教育"},"reversing":{"en":"Reversing","zh":"逆向分析"},"reverse":{"en":"Reverse","zh":"逆向"},"reverseengineering":{"en":"Reverse engineering","zh":"逆向工程"},"re":{"en":"RE","zh":"逆向工程"},"reverse-engineer":{"en":"Reverse engineer","zh":"逆向分析"},"binary-rewriting":{"en":"Binary rewriting","zh":"二进制重写"},"binary-exploitation":{"en":"Binary exploitation","zh":"二进制漏洞利用"},"binary-instrumentation":{"en":"Binary instrumentation","zh":"二进制插桩"},"binary-parser":{"en":"Binary parser","zh":"二进制解析器"},"binary-format":{"en":"Binary format","zh":"二进制格式"},"binary-diff":{"en":"Binary diff","zh":"二进制差异"},"hex-editor":{"en":"Hex editor","zh":"十六进制编辑器"},"hex":{"en":"Hex","zh":"十六进制"},"disassembly":{"en":"Disassembly","zh":"反汇编"},"decompile":{"en":"Decompile","zh":"反编译"},"deobfuscator":{"en":"Deobfuscator","zh":"去混淆工具"},"obfuscator":{"en":"Obfuscator","zh":"混淆器"},"code-analysis":{"en":"Code analysis","zh":"代码分析"},"code-generation":{"en":"Code generation","zh":"代码生成"},"source-code":{"en":"Source code","zh":"源代码"},"source-code-analysis":{"en":"Source code analysis","zh":"源代码分析"},"source-code-recovery":{"en":"Source code recovery","zh":"源码恢复"},"control-flow":{"en":"Control flow","zh":"控制流"},"control-flow-graph":{"en":"Control flow graph","zh":"控制流图"},"control-flow-flattening":{"en":"Control flow flattening","zh":"控制流平坦化"},"data-flow-analysis":{"en":"Data flow analysis","zh":"数据流分析"},"taint-analysis":{"en":"Taint analysis","zh":"污点分析"},"abstract-interpretation":{"en":"Abstract interpretation","zh":"抽象解释"},"emulation":{"en":"Emulation","zh":"模拟执行"},"virtualization":{"en":"Virtualization","zh":"虚拟化"},"virtual-machine":{"en":"Virtual machine","zh":"虚拟机"},"virtual-machines":{"en":"Virtual machines","zh":"虚拟机"},"symbolic-analysis":{"en":"Symbolic analysis","zh":"符号分析"},"concolic-execution":{"en":"Concolic execution","zh":"混合符号执行"},"memory":{"en":"Memory","zh":"内存"},"memory-analysis":{"en":"Memory analysis","zh":"内存分析"},"memory-forensics":{"en":"Memory forensics","zh":"内存取证"},"memory-scanner":{"en":"Memory scanner","zh":"内存扫描器"},"memory-editing":{"en":"Memory editing","zh":"内存编辑"},"memory-dump":{"en":"Memory dump","zh":"内存转储"},"dump":{"en":"Dump","zh":"转储"},"dumper":{"en":"Dumper","zh":"转储工具"},"patching":{"en":"Patching","zh":"补丁修改"},"patch":{"en":"Patch","zh":"补丁"},"malware":{"en":"Malware","zh":"恶意软件"},"ransomware":{"en":"Ransomware","zh":"勒索软件"},"rootkit":{"en":"Rootkit","zh":"根套件"},"antivirus":{"en":"Antivirus","zh":"反病毒"},"anti-debugging":{"en":"Anti-debugging","zh":"反调试"},"anti-analysis":{"en":"Anti-analysis","zh":"反分析"},"anti-cheat":{"en":"Anti-cheat","zh":"反作弊"},"anticheat":{"en":"Anti-cheat","zh":"反作弊"},"sandbox":{"en":"Sandbox","zh":"沙箱"},"sandboxing":{"en":"Sandboxing","zh":"沙箱隔离"},"vulnerability":{"en":"Vulnerability","zh":"漏洞"},"vulnerabilities":{"en":"Vulnerabilities","zh":"漏洞"},"vulnerability-detection":{"en":"Vulnerability detection","zh":"漏洞检测"},"vulnerability-analysis":{"en":"Vulnerability analysis","zh":"漏洞分析"},"exploit":{"en":"Exploit","zh":"漏洞利用"},"exploits":{"en":"Exploits","zh":"漏洞利用"},"exploitation":{"en":"Exploitation","zh":"漏洞利用"},"pwn":{"en":"Pwn","zh":"二进制漏洞利用"},"shellcode":{"en":"Shellcode","zh":"载荷代码"},"payload":{"en":"Payload","zh":"载荷"},"red-team":{"en":"Red team","zh":"红队"},"redteam":{"en":"Red team","zh":"红队"},"red-teaming":{"en":"Red teaming","zh":"红队测试"},"blueteam":{"en":"Blue team","zh":"蓝队"},"blue-team":{"en":"Blue team","zh":"蓝队"},"digital-forensics":{"en":"Digital forensics","zh":"数字取证"},"incident-response":{"en":"Incident response","zh":"事件响应"},"threat-hunting":{"en":"Threat hunting","zh":"威胁狩猎"},"osint":{"en":"OSINT","zh":"开源情报"},"privacy":{"en":"Privacy","zh":"隐私"},"reconnaissance":{"en":"Reconnaissance","zh":"侦察"},"recon":{"en":"Recon","zh":"侦察"},"encryption":{"en":"Encryption","zh":"加密"},"decryption":{"en":"Decryption","zh":"解密"},"crypto":{"en":"Crypto","zh":"密码学"},"cryptanalysis":{"en":"Cryptanalysis","zh":"密码分析"},"password":{"en":"Password","zh":"密码"},"password-cracking":{"en":"Password cracking","zh":"密码破解"},"api":{"en":"API","zh":"API"},"api-security":{"en":"API security","zh":"API 安全"},"api-reverse-engineering":{"en":"API reverse engineering","zh":"API 逆向工程"},"websocket":{"en":"WebSocket","zh":"WebSocket"},"webassembly":{"en":"WebAssembly","zh":"WebAssembly"},"wasm":{"en":"Wasm","zh":"Wasm"},"android":{"en":"Android","zh":"Android"},"ios":{"en":"iOS","zh":"iOS"},"macos":{"en":"macOS","zh":"macOS"},"windows":{"en":"Windows","zh":"Windows"},"linux":{"en":"Linux","zh":"Linux"},"javascript":{"en":"JavaScript","zh":"JavaScript"},"typescript":{"en":"TypeScript","zh":"TypeScript"},"python":{"en":"Python","zh":"Python"},"java":{"en":"Java","zh":"Java"},"csharp":{"en":"C#","zh":"C#"},"c-sharp":{"en":"C#","zh":"C#"},"dotnet":{"en":".NET","zh":".NET"},"rust":{"en":"Rust","zh":"Rust"},"golang":{"en":"Go","zh":"Go"},"c":{"en":"C","zh":"C"},"cpp":{"en":"C++","zh":"C++"},"c-plus-plus":{"en":"C++","zh":"C++"},"llvm":{"en":"LLVM","zh":"LLVM"},"frida":{"en":"Frida","zh":"Frida"},"ghidra":{"en":"Ghidra","zh":"Ghidra"},"ida":{"en":"IDA","zh":"IDA"},"ida-pro":{"en":"IDA Pro","zh":"IDA Pro"},"idapro":{"en":"IDA Pro","zh":"IDA Pro"},"ida-plugin":{"en":"IDA plugin","zh":"IDA 插件"},"ghidra-plugin":{"en":"Ghidra plugin","zh":"Ghidra 插件"},"frida-scripts":{"en":"Frida scripts","zh":"Frida 脚本"},"frida-script":{"en":"Frida script","zh":"Frida 脚本"},"frida-hook":{"en":"Frida hook","zh":"Frida 钩子"},"radare2":{"en":"radare2","zh":"radare2"},"rizin":{"en":"Rizin","zh":"Rizin"},"cutter":{"en":"Cutter","zh":"Cutter"},"x64dbg":{"en":"x64dbg","zh":"x64dbg"},"x64dbg-plugin":{"en":"x64dbg plugin","zh":"x64dbg 插件"},"gdb":{"en":"GDB","zh":"GDB"},"lldb":{"en":"LLDB","zh":"LLDB"},"lldb-plugin":{"en":"LLDB plugin","zh":"LLDB 插件"},"unity":{"en":"Unity","zh":"Unity"},"unity3d":{"en":"Unity 3D","zh":"Unity 3D"},"unreal-engine":{"en":"Unreal Engine","zh":"虚幻引擎"},"il2cpp":{"en":"IL2CPP","zh":"IL2CPP"},"electron":{"en":"Electron","zh":"Electron"},"apk":{"en":"APK","zh":"APK"},"dex":{"en":"DEX","zh":"DEX"},"elf":{"en":"ELF","zh":"ELF"},"pe":{"en":"PE","zh":"PE"},"x86":{"en":"x86","zh":"x86"},"x64":{"en":"x64","zh":"x64"},"arm":{"en":"Arm","zh":"Arm"},"arm64":{"en":"Arm64","zh":"Arm64"},"riscv":{"en":"RISC-V","zh":"RISC-V"},"mips":{"en":"MIPS","zh":"MIPS"},"jvm":{"en":"JVM","zh":"JVM"},"kernel":{"en":"Kernel","zh":"内核"},"driver":{"en":"Driver","zh":"驱动"},"drivers":{"en":"Drivers","zh":"驱动"},"operating-system":{"en":"Operating system","zh":"操作系统"},"embedded-systems":{"en":"Embedded systems","zh":"嵌入式系统"},"hardware":{"en":"Hardware","zh":"硬件"},"hardware-hacking":{"en":"Hardware hacking","zh":"硬件破解"},"hardware-security":{"en":"Hardware security","zh":"硬件安全"},"file-format":{"en":"File format","zh":"文件格式"},"file-formats":{"en":"File formats","zh":"文件格式"},"file-analysis":{"en":"File analysis","zh":"文件分析"},"parser":{"en":"Parser","zh":"解析器"},"parsing":{"en":"Parsing","zh":"解析"},"serialization":{"en":"Serialization","zh":"序列化"},"deserialization":{"en":"Deserialization","zh":"反序列化"},"compression":{"en":"Compression","zh":"压缩"},"extraction":{"en":"Extraction","zh":"提取"},"extractor":{"en":"Extractor","zh":"提取工具"},"asset-extraction":{"en":"Asset extraction","zh":"资源提取"},"game-assets":{"en":"Game assets","zh":"游戏资源"},"game-hacking":{"en":"Game hacking","zh":"游戏修改"},"game-modding":{"en":"Game modding","zh":"游戏模组"},"game-development":{"en":"Game development","zh":"游戏开发"},"game-engine":{"en":"Game engine","zh":"游戏引擎"},"game-tools":{"en":"Game tools","zh":"游戏工具"},"cheat":{"en":"Cheat","zh":"作弊工具"},"cheats":{"en":"Cheats","zh":"作弊工具"},"graphics":{"en":"Graphics","zh":"图形"},"rendering":{"en":"Rendering","zh":"渲染"},"gpu":{"en":"GPU","zh":"GPU"},"opengl":{"en":"OpenGL","zh":"OpenGL"},"vulkan":{"en":"Vulkan","zh":"Vulkan"},"directx":{"en":"DirectX","zh":"DirectX"},"reimplementation":{"en":"Reimplementation","zh":"重新实现"},"reconstruction":{"en":"Reconstruction","zh":"重建"},"compatibility":{"en":"Compatibility","zh":"兼容性"},"preservation":{"en":"Preservation","zh":"保存"},"software-preservation":{"en":"Software preservation","zh":"软件保存"},"software":{"en":"Software","zh":"软件"},"software-engineering":{"en":"Software engineering","zh":"软件工程"},"software-analysis":{"en":"Software analysis","zh":"软件分析"},"software-security":{"en":"Software security","zh":"软件安全"},"code-review":{"en":"Code review","zh":"代码审查"},"testing":{"en":"Testing","zh":"测试"},"unit-testing":{"en":"Unit testing","zh":"单元测试"},"integration":{"en":"Integration","zh":"集成"},"plugins":{"en":"Plugins","zh":"插件"},"extension":{"en":"Extension","zh":"扩展"},"extensions":{"en":"Extensions","zh":"扩展"},"command-line":{"en":"Command line","zh":"命令行"},"command-line-tool":{"en":"Command-line tool","zh":"命令行工具"},"gui":{"en":"GUI","zh":"图形界面"},"visualization":{"en":"Visualization","zh":"可视化"},"interactive":{"en":"Interactive","zh":"交互式"},"cross-platform":{"en":"Cross-platform","zh":"跨平台"},"open-source":{"en":"Open source","zh":"开源"},"python3":{"en":"Python 3","zh":"Python 3"},"chatgpt":{"en":"ChatGPT","zh":"ChatGPT"},"claude":{"en":"Claude","zh":"Claude"},"claude-code":{"en":"Claude Code","zh":"Claude Code"},"codex":{"en":"Codex","zh":"Codex"},"cursor":{"en":"Cursor","zh":"Cursor"},"copilot":{"en":"Copilot","zh":"Copilot"},"llm-agent":{"en":"LLM agent","zh":"大模型智能体"},"llm-agents":{"en":"LLM agents","zh":"大模型智能体"},"ai-tools":{"en":"AI tools","zh":"AI 工具"},"ai-powered":{"en":"AI-powered","zh":"AI 辅助"},"agentic":{"en":"Agentic","zh":"智能体"},"agentic-ai":{"en":"Agentic AI","zh":"AI 智能体"},"agentic-workflows":{"en":"Agentic workflows","zh":"智能体工作流"},"prompt-engineering":{"en":"Prompt engineering","zh":"提示词工程"},"skills":{"en":"Skills","zh":"技能"},"skill":{"en":"Skill","zh":"技能"},"benchmark":{"en":"Benchmark","zh":"基准测试"},"benchmarks":{"en":"Benchmarks","zh":"基准测试"},"dataset":{"en":"Dataset","zh":"数据集"},"datasets":{"en":"Datasets","zh":"数据集"},"paper":{"en":"Paper","zh":"论文"},"papers":{"en":"Papers","zh":"论文"},"academic":{"en":"Academic","zh":"学术"},"research-paper":{"en":"Research paper","zh":"研究论文"},"analyzer":{"en":"Analyzer","zh":"分析器"},"decompiler-engine":{"en":"Decompiler engine","zh":"反编译引擎"},"commandline":{"en":"Command line","zh":"命令行"},"aiagent":{"en":"AI agent","zh":"AI 智能体"},"detect":{"en":"Detection","zh":"检测"},"detector":{"en":"Detector","zh":"检测器"},"cpu-emulator":{"en":"CPU emulator","zh":"CPU 模拟器"},"cross-architecture":{"en":"Cross-architecture","zh":"跨架构"},"diffing":{"en":"Diffing","zh":"差异比较"},"bundle":{"en":"Bundle","zh":"打包"},"debundle":{"en":"Debundle","zh":"解包"},"radare2-plugin":{"en":"radare2 plugin","zh":"radare2 插件"},"idapython-plugin":{"en":"IDAPython plugin","zh":"IDAPython 插件"},"hook":{"en":"Hook","zh":"钩子"},"pentest":{"en":"Penetration testing","zh":"渗透测试"},"assembler":{"en":"Assembler","zh":"汇编器"},"infosec":{"en":"Information security","zh":"信息安全"},"mod":{"en":"Mod","zh":"模组"},"il2cpp-hacking":{"en":"IL2CPP hacking","zh":"IL2CPP 修改"},"ghidra-scripts":{"en":"Ghidra scripts","zh":"Ghidra 脚本"},"bugbounty":{"en":"Bug bounty","zh":"漏洞赏金"},"apk-decompiler":{"en":"APK decompiler","zh":"APK 反编译器"},"malware-detection":{"en":"Malware detection","zh":"恶意软件检测"},"unpacker":{"en":"Unpacker","zh":"脱壳工具"},"ethical-hacking":{"en":"Ethical hacking","zh":"道德黑客技术"},"internal":{"en":"Internal","zh":"内部"},"dfir":{"en":"Digital forensics and incident response","zh":"数字取证与事件响应"},"android-pentesting":{"en":"Android penetration testing","zh":"Android 渗透测试"},"hack":{"en":"Hacking","zh":"黑客技术"},"offensive-security":{"en":"Offensive security","zh":"进攻性安全"},"java-decompiler":{"en":"Java decompiler","zh":"Java 反编译器"},"patcher":{"en":"Patcher","zh":"补丁工具"},"portable-executable":{"en":"Portable Executable","zh":"可移植可执行文件"},"yara-rules":{"en":"YARA rules","zh":"YARA 规则"},"jadx-plugin":{"en":"JADX plugin","zh":"JADX 插件"},"ai-security":{"en":"AI security","zh":"AI 安全"},"cyber-security":{"en":"Cybersecurity","zh":"网络安全"},"android-malware":{"en":"Android malware","zh":"Android 恶意软件"},"injection":{"en":"Injection","zh":"注入"},"debugging-tool":{"en":"Debugging tool","zh":"调试工具"},"firmware-security":{"en":"Firmware security","zh":"固件安全"},"ssl-pinning":{"en":"SSL pinning","zh":"SSL 证书锁定"},"malware-development":{"en":"Malware development","zh":"恶意软件开发"},"trace":{"en":"Trace","zh":"跟踪"},"dynamic-instrumentation":{"en":"Dynamic instrumentation","zh":"动态插桩"},"game-preservation":{"en":"Game preservation","zh":"游戏保存"},"android-reverse":{"en":"Android reverse engineering","zh":"Android 逆向工程"},"sast":{"en":"Static application security testing","zh":"静态应用安全测试"},"appsec":{"en":"Application security","zh":"应用安全"},"javascript-deobfuscation":{"en":"JavaScript deobfuscation","zh":"JavaScript 去混淆"},"android-application":{"en":"Android application","zh":"Android 应用"},"embedded-linux":{"en":"Embedded Linux","zh":"嵌入式 Linux"},"application-security":{"en":"Application security","zh":"应用安全"},"steganography":{"en":"Steganography","zh":"隐写术"},"android-hacking":{"en":"Android hacking","zh":"Android 破解"},"network-forensics":{"en":"Network forensics","zh":"网络取证"},"mobile-penetration-testing":{"en":"Mobile penetration testing","zh":"移动端渗透测试"},"decomp":{"en":"Decompilation","zh":"反编译"},"devirtualization":{"en":"Devirtualization","zh":"去虚拟化"},"educational":{"en":"Educational","zh":"教学"},"il2cpp-modding":{"en":"IL2CPP modding","zh":"IL2CPP 模组制作"},"reverse-engineering-tool":{"en":"Reverse engineering tool","zh":"逆向工程工具"},"network-monitoring":{"en":"Network monitoring","zh":"网络监控"},"malware-analyzer":{"en":"Malware analyzer","zh":"恶意软件分析器"},"il2cpp-metadata":{"en":"IL2CPP metadata","zh":"IL2CPP 元数据"},"ast":{"en":"Abstract syntax tree","zh":"抽象语法树"},"9patch":{"en":"9-patch","zh":"9-patch"},"apktool":{"en":"Apktool","zh":"Apktool"},"vala":{"en":"Vala","zh":"Vala"},"cpu":{"en":"CPU","zh":"CPU"},"bpf":{"en":"BPF","zh":"BPF"},"dalvik":{"en":"Dalvik","zh":"Dalvik"},"odex":{"en":"ODEX","zh":"ODEX"},"art":{"en":"ART","zh":"ART"},"bindiff":{"en":"BinDiff","zh":"BinDiff"},"binexport":{"en":"BinExport","zh":"BinExport"},"browserify":{"en":"Browserify","zh":"Browserify"},"uefi":{"en":"UEFI","zh":"UEFI"},"nodejs":{"en":"Node.js","zh":"Node.js"},"react":{"en":"React","zh":"React"},"chrome-extension":{"en":"Chrome extension","zh":"Chrome 扩展"},"unity2d":{"en":"Unity 2D","zh":"Unity 2D"},"emscripten":{"en":"Emscripten","zh":"Emscripten"},"anti-bot":{"en":"Anti-bot","zh":"反机器人检测"},"threejs":{"en":"three.js","zh":"three.js"},"devtools":{"en":"Developer tools","zh":"开发者工具"},"cdp":{"en":"CDP","zh":"CDP"},"asar":{"en":"ASAR","zh":"ASAR"},"js":{"en":"JavaScript","zh":"JavaScript"},"retro-gaming":{"en":"Retro gaming","zh":"复古游戏"},"rea":{"en":"REA","zh":"REA"},"webgl":{"en":"WebGL","zh":"WebGL"},"playwright":{"en":"Playwright","zh":"Playwright"},"playstation":{"en":"PlayStation","zh":"PlayStation"},"manifest-v3":{"en":"Manifest V3","zh":"Manifest V3"},"babel":{"en":"Babel","zh":"Babel"},"chrome-devtools-protocol":{"en":"Chrome DevTools Protocol","zh":"Chrome 开发者工具协议"},"browser-automation":{"en":"Browser automation","zh":"浏览器自动化"},"jadx":{"en":"JADX","zh":"JADX"},"flutter":{"en":"Flutter","zh":"Flutter"},"idapython":{"en":"IDAPython","zh":"IDAPython"},"nintendo-ds":{"en":"Nintendo DS","zh":"Nintendo DS"},"x86-64":{"en":"x86-64","zh":"x86-64"},"matching-decompilation":{"en":"Matching decompilation","zh":"匹配反编译"},"hacktoberfest":{"en":"Hacktoberfest","zh":"Hacktoberfest"},"smali":{"en":"smali","zh":"smali"},"lua":{"en":"Lua","zh":"Lua"},"docker":{"en":"Docker","zh":"Docker"},"adb":{"en":"ADB","zh":"ADB"},"ds-decomp-studio":{"en":"DS Decomp Studio","zh":"DS Decomp Studio"},"bluetooth-low-energy":{"en":"Bluetooth Low Energy","zh":"低功耗蓝牙"},"mono":{"en":"Mono","zh":"Mono"},"objective-c":{"en":"Objective-C","zh":"Objective-C"},"gameboy-advance":{"en":"Game Boy Advance","zh":"Game Boy Advance"},"binwalk":{"en":"Binwalk","zh":"Binwalk"},"wireshark":{"en":"Wireshark","zh":"Wireshark"},"go":{"en":"Go","zh":"Go"},"pokemon":{"en":"Pokémon","zh":"宝可梦"},"kotlin":{"en":"Kotlin","zh":"Kotlin"},"apple":{"en":"Apple","zh":"Apple"},"ue5":{"en":"Unreal Engine 5","zh":"虚幻引擎 5"},"dart":{"en":"Dart","zh":"Dart"},"jailbreak":{"en":"Jailbreak","zh":"越狱"},"ble":{"en":"Bluetooth Low Energy (BLE)","zh":"低功耗蓝牙（BLE）"},"swift":{"en":"Swift","zh":"Swift"},"bluetooth":{"en":"Bluetooth","zh":"蓝牙"},"theos":{"en":"Theos","zh":"Theos"},"static-recompilation":{"en":"Static recompilation","zh":"静态重编译"},"mach-o":{"en":"Mach-O","zh":"Mach-O"},"metal":{"en":"Metal","zh":"Metal"},"mitm":{"en":"Man-in-the-middle","zh":"中间人"},"gamemaker":{"en":"GameMaker","zh":"GameMaker"},"frontend":{"en":"Frontend","zh":"前端"},"ue4":{"en":"Unreal Engine 4","zh":"虚幻引擎 4"},"unreal-engine-5":{"en":"Unreal Engine 5","zh":"虚幻引擎 5"},"swiftui":{"en":"SwiftUI","zh":"SwiftUI"},"iphone":{"en":"iPhone","zh":"iPhone"},"esp32":{"en":"ESP32","zh":"ESP32"},"blutter":{"en":"Blutter","zh":"Blutter"},"video-streaming":{"en":"Video streaming","zh":"视频流传输"},"nds":{"en":"Nintendo DS (NDS)","zh":"Nintendo DS（NDS）"},"hid":{"en":"Human interface devices (HID)","zh":"人机接口设备（HID）"},"private-server":{"en":"Private servers","zh":"私有服务器"},"sqlite":{"en":"SQLite","zh":"SQLite"},"webpack":{"en":"webpack","zh":"webpack"},"digital-preservation":{"en":"Digital preservation","zh":"数字保存"},"html":{"en":"HTML","zh":"HTML"},"steam":{"en":"Steam","zh":"Steam"},"ue4ss":{"en":"UE4SS","zh":"UE4SS"},"dom":{"en":"Document Object Model (DOM)","zh":"文档对象模型（DOM）"},"event-replay":{"en":"Event replay","zh":"事件重放"},"state-reconstruction":{"en":"State reconstruction","zh":"状态重建"},"apple-silicon":{"en":"Apple silicon","zh":"Apple 芯片"},"ios-reverse":{"en":"iOS reverse engineering","zh":"iOS 逆向工程"},"ios-tweak":{"en":"iOS tweaks","zh":"iOS 功能调整插件"},"can-bus":{"en":"CAN bus","zh":"CAN 总线"},"extract":{"en":"Extraction","zh":"提取"},"react-native":{"en":"React Native","zh":"React Native"},"mqtt":{"en":"MQTT","zh":"MQTT"},"flex":{"en":"FLEX","zh":"FLEX"},"tweak":{"en":"Tweaks","zh":"功能调整插件"},"kingdom-hearts":{"en":"Kingdom Hearts","zh":"王国之心"},"bluetooth-le":{"en":"Bluetooth LE","zh":"低功耗蓝牙"},"usb":{"en":"USB","zh":"USB"},"usb-hid":{"en":"USB HID","zh":"USB 人机接口设备"},"tkinter":{"en":"Tkinter","zh":"Tkinter"},"game-server":{"en":"Game servers","zh":"游戏服务器"},"codewarrior":{"en":"CodeWarrior","zh":"CodeWarrior"},"ds-decomp":{"en":"Nintendo DS decompilation","zh":"Nintendo DS 反编译"},"sdl2":{"en":"SDL2","zh":"SDL2"},"ai-assisted":{"en":"AI-assisted","zh":"AI 辅助"},"save-editor":{"en":"Save editor","zh":"存档编辑器"},"datamining":{"en":"Data mining","zh":"数据挖掘"},"modding-tools":{"en":"Modding tools","zh":"模组制作工具"},"fmod":{"en":"FMOD","zh":"FMOD"},"userscript":{"en":"Userscripts","zh":"用户脚本"},"source-maps":{"en":"Source maps","zh":"源码映射"},"css":{"en":"CSS","zh":"CSS"},"web-platform":{"en":"Web platform","zh":"Web 平台"},"recompilation":{"en":"Recompilation","zh":"重编译"},"pc-port":{"en":"PC port","zh":"PC 移植"},"rexglue":{"en":"ReXGlue","zh":"ReXGlue"},"ipa":{"en":"IPA","zh":"IPA"},"n64":{"en":"Nintendo 64","zh":"Nintendo 64"},"xbox360":{"en":"Xbox 360","zh":"Xbox 360"}},"category_labels":{"core":["Official REA: core and setup","REA 官方：核心与配置"],"workflow-guides":["Official REA: investigation guides","REA 官方：调查指南"],"official-case-studies":["Official REA: case studies","REA 官方：案例"],"community-integrations":["Community REA integrations","REA 社区集成"],"community-labs":["Community REA labs","REA 社区练习"],"community-case-studies":["Community REA investigations","REA 社区调查案例"],"reconstruction-cases":["Independent reconstruction cases","独立重建案例"],"agent-mcp":["Independent MCP integrations","独立 MCP 集成"],"agent-workflows":["Independent agent workflows","独立智能体工作流"],"game-analysis":["Game analysis tools","游戏分析工具"],"web-analysis":["Website analysis tools","网站分析工具"],"protocol-analysis":["Protocol analysis tools","协议分析工具"],"native-analysis":["Native analysis tools","原生分析工具"],"dynamic-analysis":["Debugging and dynamic analysis","调试与动态分析"],"android":["Android tools","Android 工具"],"dotnet":[".NET tools",".NET 工具"],"jvm":["JVM bytecode tools","JVM 字节码工具"],"javascript-electron":["JavaScript and Electron tools","JavaScript 与 Electron 工具"],"webassembly":["WebAssembly tools","WebAssembly 工具"],"firmware":["Firmware tools","固件工具"],"binary-libraries":["Binary analysis libraries","二进制分析库"],"binary-diffing":["Binary comparison tools","二进制对比工具"],"learning":["Learning resources","学习资源"],"related-lists":["Related resource lists","相关资源目录"]},"source_category_labels":{"web-analysis":["Websites","网站"],"game-analysis":["Games","游戏"],"android":["Apps · Android","应用 · Android"],"managed-code":["Apps · Managed code","应用 · 托管代码"],"native-analysis":["Native binaries","原生二进制"],"dynamic-analysis":["Runtime and debugging","运行时与调试"],"firmware":["Firmware","固件"],"protocol-analysis":["Protocols","协议"],"reverse-engineering":["General tools and collections","通用工具与资源合集"]},"resources":[{"id":"rea-upstream","name":"REA — Reverse Engineer Anything","name_zh":"REA — Reverse Engineer Anything","url":"https://github.com/morluto/rea","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/README.md","description_en":"The upstream CLI and MCP server for evidence-based investigations of shipped software and runtime behavior.","description_zh":"REA 官方 CLI 与 MCP 服务，连接分析工具并保留调查证据及限制。","kind":"project","category":"core","group":"rea","relationship":"official-core","targets":["app","binary","firmware","game","protocol","website"],"verified_at":"2026-10-15"},{"id":"rea-official-skill","name":"Official reverse-engineer-anything skill","name_zh":"官方 reverse-engineer-anything 技能","url":"https://github.com/morluto/rea/tree/main/.agents/skills/reverse-engineer-anything","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/.agents/skills/reverse-engineer-anything/SKILL.md","description_en":"Target routing, connection recovery and evidence practices for agents using REA.","description_zh":"官方面向使用者的调查技能，包含目标路由、连接恢复与证据工作流。","kind":"integration","category":"core","group":"rea","relationship":"official-skill","targets":["app","binary","firmware","game","protocol","website"],"verified_at":"2026-10-15"},{"id":"rea-installation","name":"Installation and client setup","name_zh":"安装与客户端配置","url":"https://github.com/morluto/rea/blob/main/docs/installation.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/installation.md","description_en":"Reviewed setup plans, client registration, provider prerequisites and scoped readiness checks.","description_zh":"安装、客户端配置、分析引擎依赖及按任务检查就绪状态的官方入口。","kind":"documentation","category":"core","group":"rea","relationship":"official-documentation","targets":["app","binary","firmware","game","website"],"verified_at":"2026-10-15"},{"id":"rea-cli-evidence","name":"CLI and Evidence","name_zh":"CLI 与 Evidence","url":"https://github.com/morluto/rea/blob/main/docs/cli.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/cli.md","description_en":"CLI workflows for saving Evidence and projecting smaller views from completed analysis.","description_zh":"保存完整 Evidence，再提取摘要或模块视图，适合脚本与可复现记录。","kind":"documentation","category":"core","group":"rea","relationship":"official-documentation","targets":["app","binary","firmware","game","website"],"verified_at":"2026-10-15"},{"id":"rea-mcp-contracts","name":"MCP contracts and generated catalog","name_zh":"MCP 接口约定与生成目录","url":"https://github.com/morluto/rea/blob/main/docs/mcp-contracts.md#generated-catalog","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/mcp-contracts.md","description_en":"Canonical tool contracts, provider discovery and Evidence semantics for integration authors.","description_zh":"官方工具协议、能力发现和 Evidence 语义；适合集成与核对实际工具边界。","kind":"documentation","category":"core","group":"rea","relationship":"official-documentation","targets":["app","binary","firmware","game","website"],"verified_at":"2026-10-15"},{"id":"rea-native-workflow","name":"Native binary investigation","name_zh":"原生二进制调查","url":"https://github.com/morluto/rea/blob/main/docs/native-investigation.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/native-investigation.md","description_en":"Locate a function, inspect instructions and pseudocode, and follow references with a selected native provider.","description_zh":"从函数清单到指令、伪代码和引用链的原生二进制调查流程。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"rea-js-workflows","name":"Cross-layer JavaScript application workflows","name_zh":"跨层 JavaScript 应用工作流","url":"https://github.com/morluto/rea/blob/main/docs/javascript-application-workflows.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/javascript-application-workflows.md","description_en":"Trace features and compare authenticated JavaScript application graphs while preserving static-analysis limits.","description_zh":"从 JavaScript 应用图追踪功能、比较版本，同时保留静态分析的不确定性。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["app","website"],"verified_at":"2026-10-15"},{"id":"rea-android-guide","name":"Static Android APK analysis","name_zh":"Android APK 静态分析","url":"https://github.com/morluto/rea/blob/main/docs/android-analysis.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/android-analysis.md","description_en":"Inspect Android package identity, classes, methods and references through REA's JADX integration.","description_zh":"经 REA 的 JADX 集成检查 APK、类、方法与引用；结果不等于运行时验证。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["app"],"verified_at":"2026-10-15"},{"id":"rea-managed-guide","name":"Managed-code analysis","name_zh":"托管代码分析","url":"https://github.com/morluto/rea/blob/main/docs/managed-code-analysis.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/managed-code-analysis.md","description_en":"Read PE/CLI metadata and CIL, compare managed members and inspect declared native boundaries without loading the assembly.","description_zh":"静态读取 .NET 元数据与 CIL，比较成员并检查声明的原生代码边界。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["app"],"verified_at":"2026-10-15"},{"id":"rea-web-captures","name":"Historical web network captures","name_zh":"历史网站网络记录","url":"https://github.com/morluto/rea/blob/main/docs/web-network-captures.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/web-network-captures.md","description_en":"Inspect saved web captures offline; recorded URLs are not fetched and no proxy is started.","description_zh":"离线检查已有 HAR、SAZ 等网页流量记录；不会自动抓包或访问记录中的 URL。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["app","protocol","website"],"verified_at":"2026-10-15"},{"id":"rea-firmware-guide","name":"Firmware analysis","name_zh":"固件分析","url":"https://github.com/morluto/rea/blob/main/docs/firmware-analysis.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/firmware-analysis.md","description_en":"Inspect firmware regions with Binwalk and explicitly extract with Unblob, retaining tool and artifact identity.","description_zh":"用 Binwalk 检查固件区域、用 Unblob 显式提取，并记录工具与制品身份。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["firmware"],"verified_at":"2026-10-15"},{"id":"rea-packet-captures","name":"Recorded packet capture inspection","name_zh":"抓包记录检查","url":"https://github.com/morluto/rea/blob/main/docs/packet-captures.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/packet-captures.md","description_en":"Select TShark fields, display filters and decode-as rules over an existing network, USB or Bluetooth capture, and look up installed field names. It does not capture traffic, open an interface or control a device.","description_zh":"用 TShark 字段、显示过滤器和 decode-as 规则检查已有的网络、USB 或蓝牙抓包，并可查询已安装的字段名；不抓取流量、不打开网络接口，也不控制设备。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"rea-pcap-summaries","name":"Packet capture summaries","name_zh":"抓包摘要","url":"https://github.com/morluto/rea/blob/main/docs/pcap-analysis.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/pcap-analysis.md","description_en":"Summarize a saved pcap or pcapng file’s endpoints, DNS questions and addresses, TLS SNI, protocol stacks and HTTP URIs into paged Evidence views. It does not capture traffic or fetch recorded targets.","description_zh":"把已保存 pcap/pcapng 文件中的端点、DNS 查询与地址、TLS SNI、协议栈和 HTTP URI 汇总为可分页的 Evidence 视图；不抓取流量，也不访问记录中的目标。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"rea-signal-recordings","name":"Recorded signal decoding","name_zh":"信号记录解码","url":"https://github.com/morluto/rea/blob/main/docs/signal-recordings.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/signal-recordings.md","description_en":"Run caller-chosen sigrok protocol decoders, such as UART or I2C, over an existing logic-signal recording and keep annotation text with sample ranges. It does not acquire samples or communicate with hardware.","description_zh":"用调用方指定的 sigrok 协议解码器（如 UART、I2C）解码已有的逻辑信号记录，并保留带采样区间的注释文本；不采集样本，也不与硬件通信。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["firmware","protocol"],"verified_at":"2026-10-17"},{"id":"rea-browser-guide","name":"Browser observation guide","name_zh":"浏览器观察指南","url":"https://rea.tools/guides/browser/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/guide-examples.md","description_en":"Follow a user-triggered export request in the supplied Notes browser example and connect it to the downloaded result.","description_zh":"通过官方 Notes 示例关联用户点击、导出请求与下载结果；REA 负责观察。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-guide","targets":["website"],"verified_at":"2026-10-15"},{"id":"rea-aegis-case","name":"Aegis: trace a login-code calculation","name_zh":"Aegis：追踪登录验证码计算","url":"https://rea.tools/showcase/aegis/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/aegis-login-code.md","description_en":"An official APK investigation follows TOTP methods in Aegis and publishes artifact identities and selected Evidence.","description_zh":"追踪 Aegis APK 的 TOTP 计算，官方公开目标指纹与选取的调查证据。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["app"],"verified_at":"2026-10-15"},{"id":"rea-ctf-case","name":"DownUnderCTF: masked-squares flag checker","name_zh":"DownUnderCTF：masked-squares 校验器","url":"https://rea.tools/showcase/ctf/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/ctf-masked-squares.md","description_en":"An official educational challenge investigation connects binary checks to equations and records an original-program validation.","description_zh":"官方教育 CTF 案例：从检查函数得到方程，并记录原程序验证过程。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["binary"],"verified_at":"2026-10-15"},{"id":"rea-dxball-case","name":"DX-Ball: reconstruct sound panning","name_zh":"DX-Ball：重建声音声像计算","url":"https://rea.tools/showcase/dx-ball/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/dx-ball-sound-pan.md","description_en":"Recover one sound-pan function from instructions and constants; upstream cites 3,205 cases and a 63-byte match.","description_zh":"根据指令与常量重建单个声像函数；上游报告 3,205 例与 63 字节匹配。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"rea-notion-case","name":"Notion: trace the clipboard bridge","name_zh":"Notion：追踪剪贴板桥接","url":"https://rea.tools/showcase/notion/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/notion-clipboard.md","description_en":"Trace a packaged Electron clipboard path using REA findings and separate source inspection; the dynamic wrapper remains a stated limit.","description_zh":"结合 REA 发现与独立源码阅读追踪剪贴板桥；动态包装器仍有明确限制。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["app"],"verified_at":"2026-10-15"},{"id":"rea-th04-case","name":"TH04: recover a DOS bullet-ring helper","name_zh":"TH04：恢复 DOS 子弹环辅助函数","url":"https://rea.tools/showcase/th04/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/th04-bullet-ring.md","description_en":"Inspect a 16-bit PC-98 DOS helper and relate its angle calculation to a pinned reconstruction and historical compiler checks.","description_zh":"检查 PC-98 DOS 的 16 位弹幕角度辅助函数，并关联固定版本重建与历史编译器检查。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"rea-electron-guide","name":"JavaScript and Electron: follow a CSV export","name_zh":"JavaScript 与 Electron：追踪 CSV 导出","url":"https://rea.tools/guides/javascript/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/guide-examples.md","description_en":"A source-owned Notes fixture teaches the renderer, preload, IPC and CSV path with linked analysis evidence.","description_zh":"官方自建 Notes 样例，从 renderer、preload、IPC 到 CSV 导出建立证据链。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-guide","targets":["app"],"verified_at":"2026-10-15"},{"id":"rea-playbook","name":"rea-playbook","name_zh":"rea-playbook","url":"https://github.com/jinshi666888/rea-playbook","evidence_url":"https://github.com/jinshi666888/rea-playbook/blob/0ad65a85139025f32402be13ed64c8003e39b00a/README.md","description_en":"An Electron practice target, Evidence extractor and MCP probe; offline fixture mode is distinguished from real REA analysis.","description_zh":"提供 Electron 练习目标、Evidence 提取与 MCP 探测，区分离线展示和真正调用 REA。","kind":"learning-resource","category":"community-labs","group":"learn","relationship":"community-learning-resource","targets":["app"],"verified_at":"2026-10-15"},{"id":"dsh-mcp-rea","name":"dsh-mcp-rea","name_zh":"dsh-mcp-rea","url":"https://github.com/Ersith/dsh-mcp-rea","evidence_url":"https://github.com/Ersith/dsh-mcp-rea/blob/74e82f09e3f78fc945e07321d729e2e6b56406a8/README.md","description_en":"A community MCP bridge presents a smaller selected tool surface and forwards explicit commands to the REA CLI.","description_zh":"社区 MCP 适配桥，以精选工具和 CLI 转发缩小宿主需要处理的工具面。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["app","binary","firmware","game","website"],"verified_at":"2026-10-15"},{"id":"rea-jev","name":"rea-jev","name_zh":"rea-jev","url":"https://github.com/juan-viox/rea-jev","evidence_url":"https://github.com/juan-viox/rea-jev/blob/236f149638971d1c98399fc9de864378b2011bfd/README.md","description_en":"A Claude Code plugin adds Jev-based routing and evidence checks around a pinned REA MCP integration.","description_zh":"Claude Code 社区插件，在固定版本 REA MCP 外增加 Jev 路由和证据检查。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["app","website"],"verified_at":"2026-10-17T12:48:42Z"},{"id":"rea-lab","name":"rea-lab","name_zh":"rea-lab","url":"https://github.com/pablodiazjorge/rea-lab","evidence_url":"https://github.com/pablodiazjorge/rea-lab/blob/c96b76b75046fc884b8d7526205f1adb9497a5d7/README.md","description_en":"A Windows REA/Ghidra lab with seeded challenges, published studies, upstream contributions and recorded limitations.","description_zh":"Windows REA/Ghidra 实验室，提供已知答案挑战、公开研究、上游贡献与限制说明。","kind":"research","category":"community-labs","group":"learn","relationship":"community-learning-resource","targets":["binary"],"verified_at":"2026-10-17"},{"id":"rea-casebook","name":"rea-casebook","name_zh":"rea-casebook","url":"https://github.com/pablodiazjorge/rea-casebook","evidence_url":"https://github.com/pablodiazjorge/rea-casebook/blob/311c29688c82048971b2ef86df59e0ed78310fd8/README.md","description_en":"A Claude Code mod collects received REA Evidence, tracks unknowns and records findings that cite delivered evidence IDs.","description_zh":"Claude Code mod 汇集收到的 REA Evidence、追踪 unknown，并校验发现所引用的证据 ID。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["binary"],"verified_at":"2026-10-15"},{"id":"picoprint-rea-investigation","name":"PicoPrint: LX-D02 printer investigation","name_zh":"PicoPrint：LX-D02 打印机调查","url":"https://github.com/bigtower17/picoprint","evidence_url":"https://github.com/morluto/rea/discussions/4152","description_en":"The author describes REA-assisted Android investigation followed by separate Hermes decompilation to support a Windows BLE printer.","description_zh":"作者报告以 REA 开始 Android 调查，再借助独立 Hermes 工具实现 Windows BLE 打印。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app","protocol"],"verified_at":"2026-10-15"},{"id":"morluto-awesome-re","name":"Awesome Reverse Engineering","name_zh":"Awesome Reverse Engineering","url":"https://github.com/morluto/awesome-reverse-engineering","evidence_url":"https://github.com/morluto/awesome-reverse-engineering/blob/901e752191ebdff4f1b8e1a2f15c82fef2de77e7/README.md","description_en":"A task-oriented reverse-engineering resource list by REA's maintainer, useful for broader tools and foundations.","description_zh":"REA 维护者整理的通用逆向资源目录，适合查找基础知识与相邻工具。","kind":"collection","category":"related-lists","group":"learn","relationship":"upstream-maintainer-companion-list","targets":["app","binary","firmware","game","protocol","website"],"verified_at":"2026-10-17T12:48:42Z"},{"id":"awesome-rea-cases","name":"Awesome REA Cases","name_zh":"Awesome REA Cases","url":"https://github.com/songshikang0111/awesome-REA-cases","evidence_url":"https://github.com/songshikang0111/awesome-REA-cases/blob/afea8a6c6ea29559533cf5ba4063e15b6649e0af/README.md","description_en":"A bilingual collection of REA and other AI-assisted reverse engineering cases, with source links and explicit distinctions between reported and reproduced outcomes.","description_zh":"中英双语的 REA 与其他 AI 辅助逆向案例合集，附来源并区分作者报告、进行中的工作和复现状态。","kind":"collection","category":"related-lists","group":"learn","relationship":"community-learning-resource","targets":["app","binary","firmware","game","protocol","website"],"verified_at":"2026-10-17T12:48:42Z"},{"id":"reacut-reconstruction","name":"ReaCut: video-editor reconstruction","name_zh":"ReaCut：视频编辑器重建案例","url":"https://github.com/Xiangyu-CAS/rea-capcut","evidence_url":"https://github.com/Xiangyu-CAS/rea-capcut/blob/da6f2f81473d90ad18d2c0d90220f21429f0c96f/README.md","description_en":"An independent video editor whose authors document REA-assisted investigation of Jianying/CapCut behavior and project formats. The public implementation includes a local timeline, FFmpeg export and an experimental, lossy draft importer.","description_zh":"独立视频编辑器，作者公开了利用 REA 研究剪映／CapCut 行为与项目格式的过程。实现包含本地时间线、FFmpeg 导出，以及实验性的有损草稿导入。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-16"},{"id":"open-appleremote-case","name":"open-appleremote: Siri Remote protocol reconstruction","name_zh":"open-appleremote：Siri Remote 协议重建","url":"https://github.com/a-funk/open-appleremote","evidence_url":"https://github.com/a-funk/open-appleremote/blob/1e6e190c3c29a3d2d8cad2c38c09f8953e9633e3/README.md","description_en":"Reconstructs first-generation Siri Remote Bluetooth reports for Linux, decoding buttons, touch and tvOS-style gestures. The Python implementation and protocol notes distinguish measured behavior, historical reports and inferred meanings.","description_zh":"重建第一代 Siri Remote 在 Linux 上的蓝牙报告，解析按键、触摸与 tvOS 风格手势。Python 实现和协议文档区分实测行为、历史报告与推测含义。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"gamekb-k17-case","name":"GAMEKB-K17: reconstructing a macropad configuration protocol","name_zh":"GAMEKB-K17：重建宏键盘配置协议","url":"https://github.com/dvdarkin/gamekb-k17","evidence_url":"https://github.com/dvdarkin/gamekb-k17/blob/e61f444793857c0e10a31692674335ee4ee9c89e/README.md","description_en":"Implements the vendor HID configuration protocol for the GAMEKB-K17/HCY-K017 macropad. It writes key mappings, firmware macros and RGB settings, then reads them back; protocol notes separate tested commands from unconfirmed observations and other-device findings.","description_zh":"实现 GAMEKB-K17/HCY-K017 宏键盘的厂商 HID 配置协议，写入按键映射、固件宏和 RGB 设置后再读回核对。协议文档区分已测试命令、未确认观察和其他设备的研究结果。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"cf632ble-case","name":"CF632BLE: a local client from scale-protocol research","name_zh":"CF632BLE：基于体脂秤协议研究的本地客户端","url":"https://github.com/guyru/cf632ble","evidence_url":"https://github.com/guyru/cf632ble/blob/c029ef5cfefbd323ffe2a194a75db5cc47aa6d5c/README.md","description_en":"Reimplements the CF632BLE scale’s BLE protocol and body-composition calculations from research on the vendor’s Unique Health Android app. A static Web Bluetooth client receives measurements, manages device profiles and keeps its history in browser storage.","description_zh":"根据对厂商 Unique Health 安卓应用的研究，重实现 CF632BLE 体脂秤的 BLE 协议和体成分计算。静态 Web Bluetooth 客户端接收测量数据、管理设备档案，并将历史记录保存在浏览器中。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-17"},{"id":"zee-rp-case","name":"zee-rp: reconstructing supported Axure RP 11 document operations","name_zh":"zee-rp：重建 Axure RP 11 的受支持文档操作","url":"https://github.com/LilZeeCN/zee-rp","evidence_url":"https://github.com/LilZeeCN/zee-rp/blob/473761e6a08f051e1666944db690332ef27a6038/README.md","description_en":"Reads and rewrites supported native Axure RP 11 documents through a binary-record codec, reference-aware cloning and constrained interaction writers. CLI and MCP interfaces expose inspected edits while keeping offline structure checks separate from native application acceptance.","description_zh":"通过二进制记录编解码、考虑引用关系的克隆和受约束的交互写入器，读取并修改受支持的 Axure RP 11 原生文档。CLI 与 MCP 接口提供可检查的编辑操作，并区分离线结构检查和原生应用验收。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-17"},{"id":"sm64ds-decomp-case","name":"Super Mario 64 DS: matching decompilation with relocation checks","name_zh":"Super Mario 64 DS：带重定位核对的匹配反编译","url":"https://github.com/tangosdev/sm64ds-decomp","evidence_url":"https://github.com/tangosdev/sm64ds-decomp/blob/af8636d638322b88738ef7ad4b4f28ed9c5be24f/README.md","description_en":"Reconstructs Super Mario 64 DS functions as C/C++ and permitted assembly primitives, comparing compiled output with a user-supplied cartridge dump. Independent relocation-destination checks strengthen the matching gate; integration into the PC port is tracked separately.","description_zh":"将 Super Mario 64 DS 函数重建为 C/C++ 和规则允许的汇编原语，并将编译结果与用户提供的卡带转储对比。独立的重定位目标核对强化匹配检查；PC 移植中的集成进度另行统计。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"goldeneye-pc-port-case","name":"GoldenEye 007: an agent-assisted native port from a decompilation","name_zh":"GoldenEye 007：基于反编译成果的智能体辅助原生移植","url":"https://github.com/jkdansereau/goldeneye-pc-port","evidence_url":"https://github.com/jkdansereau/goldeneye-pc-port/blob/fda76b69837e6c5aae436e0d3e798989e49b06d2/README.md","description_en":"Builds a native PC port on the existing GoldenEye 007 decompilation, with a host platform layer and assets extracted from the user’s ROM. The project documents agent collaboration, rendering comparisons, playtest scope and unresolved platform support.","description_zh":"在已有 GoldenEye 007 反编译成果之上构建原生 PC 移植，提供宿主平台适配层，并从用户自己的 ROM 提取资产。项目记录智能体协作、渲染对比、试玩范围和尚未解决的平台支持。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"ssbu-recomp-case","name":"ssbu-recomp: static recompilation with explicit mode limits","name_zh":"ssbu-recomp：明确玩法边界的静态重编译","url":"https://github.com/Denkishi/ssbu-recomp","evidence_url":"https://github.com/Denkishi/ssbu-recomp/blob/938e66bb7be0ba4123e291211895412da421b705/README.md","description_en":"Translates Super Smash Bros. Ultimate 13.0.4 AArch64 code ahead of time and supplies a Windows runtime with Vulkan/OpenGL rendering. It also reconstructs selected fighter scripts as editable C++ and compares translated/source behavior through differential and deterministic tests.","description_zh":"将 Super Smash Bros. Ultimate 13.0.4 的 AArch64 代码提前转换，并提供带 Vulkan/OpenGL 渲染的 Windows 运行时。项目还将部分角色脚本重建为可编辑 C++，通过差分与确定性测试对比转换代码和源码行为。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"kartpad-case","name":"KartPad: platform integration for a Mario Kart Wii recompilation","name_zh":"KartPad：Mario Kart Wii 重编译的平台集成","url":"https://github.com/chrissotraidis/kartpad","evidence_url":"https://github.com/chrissotraidis/kartpad/blob/7e99c6776263caa85dccde2de6281cb092778877/README.md","description_en":"Builds Apple and Android integration around WiiCompiled’s ahead-of-time translation of Mario Kart Wii, with native graphics, input and optional Retro Rewind support. Its status and rights documents distinguish platform acceptance, unresolved device defects and game-content requirements.","description_zh":"围绕 WiiCompiled 对 Mario Kart Wii 的提前转换实现 Apple 与 Android 平台集成，提供原生图形、输入及可选 Retro Rewind 支持。状态和权利文档区分平台验收、未解决的设备缺陷及游戏内容要求。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"battleship-port-case","name":"BattleShip: an AI-assisted Super Smash Bros. native port","name_zh":"BattleShip：AI 辅助的 Super Smash Bros. 原生移植","url":"https://github.com/JRickey/BattleShip","evidence_url":"https://github.com/JRickey/BattleShip/blob/39e978fbffe06a24f718bdf1ca740f27ad6a7dec/README.md","description_en":"Ports the existing Super Smash Bros. N64 decompilation using libultraship and Torch. The author’s earlier README describes agent-built graphics/audio comparison tools and differential debugging against emulator behavior, rather than claiming AI recovered the game from a cartridge without prior community work.","description_zh":"使用 libultraship 和 Torch 移植已有的 Super Smash Bros. N64 反编译成果。作者早期的 README 介绍了智能体构建的图形、音频对比工具和对照模拟器行为的差分调试，并未将其说成脱离社区既有成果、仅靠卡带自动恢复游戏。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"agent-decompilation-oracle-case","name":"Agent decompilation: a byte-matching retrospective","name_zh":"智能体反编译：字节匹配验收复盘","url":"https://momo5502.com/posts/2026-10-09-game-decompilation/","evidence_url":"https://momo5502.com/posts/2026-10-09-game-decompilation/","description_en":"Maurice Heumann describes replacing plausible-looking agent output with compiler-based checks of reconstructed functions, relocations, data and types. The retrospective reports 99% function presence and 83% of all functions byte-exact, while keeping the reconstruction code private.","description_zh":"Maurice Heumann 介绍如何用基于编译器的函数、重定位、数据和类型检查，取代看似合理的智能体输出。复盘报告 99% 的函数已进入重建源码，全部函数中 83% 达到字节一致；重建代码仍不公开。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"snowboardkids2-decomp-case","name":"Snowboard Kids 2: an LLM-assisted N64 matching decompilation","name_zh":"Snowboard Kids 2：大模型辅助的 N64 匹配反编译","url":"https://github.com/cdlewis/snowboardkids2-decomp","evidence_url":"https://github.com/cdlewis/snowboardkids2-decomp/blob/352a26fae08b3394e11f5e2b589e41a572d53288/README.md","description_en":"A public matching decompilation of the N64 game Snowboard Kids 2, begun in 2024 with community decompilation tools. The author’s dated posts document Claude, Codex and GLM workflows, including headless one-shot loops, similarity-based function scheduling and hook-guarded, hash-checked builds, through a reported complete function match.","description_zh":"N64 游戏 Snowboard Kids 2 的公开匹配反编译项目，2024 年借助社区反编译工具启动。作者在按日期发布的文章中记录了 Claude、Codex 和 GLM 的使用流程，包括无界面的一次性匹配循环、按函数相似度安排任务，以及由钩子约束、经哈希校验的构建，直至报告全部函数完成匹配。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"yibie-awesome-rea","name":"awesome-rea (yibie): verification-focused projects and practice reports","name_zh":"awesome-rea（yibie）：关注验证的项目与实践报告","url":"https://github.com/yibie/awesome-rea","evidence_url":"https://github.com/yibie/awesome-rea/blob/6df1bc922ac6b92dcd1b2f905c94d8cc4f3b5a3e/README.md","description_en":"Organizes AI-assisted game decompilation, native ports, static recompilation and tooling around stated acceptance checks, alongside a separate track of practitioner write-ups and discussions. Useful for finding primary reports and comparing how projects define correctness.","description_zh":"围绕明确的验收检查整理 AI 辅助游戏反编译、原生移植、静态重编译和工具，并另设实践文章与讨论分类。适合寻找一手报告，比较不同项目如何定义正确性。","kind":"collection","category":"related-lists","group":"learn","relationship":"community-learning-resource","targets":["binary","game"],"verified_at":"2026-10-17"},{"id":"cooler-lcd-case","name":"cooler-lcd: a Thermalright display protocol implementation","name_zh":"cooler-lcd：Thermalright 显示屏协议实现","url":"https://github.com/kristjaningi/cooler-lcd","evidence_url":"https://github.com/kristjaningi/cooler-lcd/blob/9a343678ba102de784b2302f79c53fd6ddc31ab9/README.md","description_en":"Implements a USB picture-transfer driver for Thermalright Vision cooler displays, with a Rust dashboard replacing the vendor display application. The documented protocol sends a header and JPEG frames, with periodic resends to prevent the device reverting to its logo.","description_zh":"为 Thermalright Vision 散热器显示屏实现 USB 图像传输驱动，并用 Rust 仪表盘替代厂商显示应用。文档所述协议发送报头和 JPEG 帧，通过定期重发避免设备退回品牌标志画面。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"isaacrecomp-case","name":"IsaacRecomp: translating Flash game bytecode to native C++","name_zh":"IsaacRecomp：将 Flash 游戏字节码转换为原生 C++","url":"https://github.com/whylurking/IsaacRecomp","evidence_url":"https://github.com/whylurking/IsaacRecomp/blob/7736f3d2961051b66cd315bcf5a719e9024d889d/README.md","description_en":"Translates The Binding of Isaac’s Flash AVM1 bytecode into C++ functions and supplies a native rendering/input runtime. The project reads graphics and audio from the user’s original game and documents deterministic input, headless runs and screenshot regression checks.","description_zh":"将 The Binding of Isaac 的 Flash AVM1 字节码转换为 C++ 函数，并提供原生渲染与输入运行时。项目从用户自己的原游戏读取图像和音频，并记录了确定性输入、无界面运行和截图回归检查。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"vd-streamer-linux-case","name":"Virtual Desktop Streamer: rehosting the platform layer on Linux","name_zh":"Virtual Desktop Streamer：在 Linux 上重建平台适配层","url":"https://github.com/cudanexus/vd-streamer-linux","evidence_url":"https://github.com/cudanexus/vd-streamer-linux/blob/e65c302f13639f044742bdc4951ab1a424c1c929/README.md","description_en":"An author-reported Claude Code and REA workflow replaces the macOS streamer’s capture, encoding, audio and input layer with Linux implementations while reusing vendor protocol libraries. The documented result targets desktop streaming and video playback, not Windows-only VR game streaming.","description_zh":"作者报告通过 Claude Code 与 REA，将 macOS 串流端的捕获、编码、音频和输入层替换为 Linux 实现，同时复用厂商协议库。文档中的目标是桌面串流和视频播放，而非仅 Windows 串流端提供的 VR 游戏串流。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-17"},{"id":"open-claude-ui-case","name":"Open Claude UI: REA-informed interface reference components","name_zh":"Open Claude UI：基于 REA 调查的界面参考组件","url":"https://github.com/Caho1/open-claude-ui","evidence_url":"https://github.com/Caho1/open-claude-ui/blob/ddf3aea1711db62fd6d24343bbab500a5ae69f64/README.md","description_en":"Publishes React components, motion helpers and design-system notes derived from the author’s reported REA investigation of Claude Desktop. It is useful as an interface-reconstruction case, with version-specific observations rather than proof of a complete assistant application or backend clone.","description_zh":"发布 React 组件、动效辅助模块和设计系统笔记，作者将其归因于使用 REA 调查 Claude Desktop。它可作为界面重建案例；观察结果受版本约束，不能证明已完整复刻助手应用或后端。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-17"},{"id":"nanolathe-case","name":"Nanolathe: a documented Total Annihilation engine reimplementation","name_zh":"Nanolathe：附研究文档的 Total Annihilation 引擎重实现","url":"https://github.com/nanolathe-gg/nanolathe","evidence_url":"https://github.com/nanolathe-gg/nanolathe/blob/5007ba75354c06fc9752a2822d37ff1e1443b77b/README.md","description_en":"Reimplements a Total Annihilation-compatible strategy-game engine in Go, with public file-format research and separate gameplay profiles. It distinguishes intended retail 3.1 behavior from community-patch research and deliberate modern changes, and separates synthetic checks from tests requiring original game data.","description_zh":"用 Go 重实现兼容 Total Annihilation 的策略游戏引擎，公开文件格式研究并提供不同玩法配置。项目区分拟复现的零售版3.1行为、社区补丁研究和有意加入的现代改动，也区分合成检查与依赖原始游戏数据的测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"plx-native-case","name":"PlxNative: reconstructing a native webOS media-client interface","name_zh":"PlxNative：重建原生 webOS 媒体客户端接口","url":"https://github.com/GLinnik21/plx-native","evidence_url":"https://github.com/GLinnik21/plx-native/blob/0b0b22092b204432834c75f32148dbd16ec3493b/README.md","description_en":"An unofficial Plex client built after the author investigated LG webOS native media interfaces with Ghidra and coding agents. It draws its own Rust/OpenGL interface and uses the television’s decoder, with documented host, simulator and real-device test tiers.","description_zh":"作者用 Ghidra 和编程智能体调查 LG webOS 原生媒体接口后构建的非官方 Plex 客户端。它自行绘制 Rust/OpenGL 界面并使用电视解码器，文档区分宿主测试、模拟器测试和实体设备测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-17"},{"id":"th08-reconstruction-case","name":"TH08: exact-source reconstruction and separately tested ports","name_zh":"TH08：精确源码重建与单独验证的移植","url":"https://github.com/N0zoM1z0/th08","evidence_url":"https://github.com/N0zoM1z0/th08/blob/08c7f00f81e35db8206d917b14f47883930beef6/README.md","description_en":"Reconstructs the original Japanese Touhou 8 version 1.00d against its binary and original compiler, then adapts the recovered code for other platforms. Source presence, strict function matching, whole-executable identity and playable-port checks are recorded as different milestones.","description_zh":"依据原二进制和原编译器重建日版 Touhou 8 的 1.00d 版本，再将恢复的代码适配到其他平台。项目分别记录源码存在、严格函数匹配、完整可执行文件一致性和移植可玩性里程碑。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"rea-dinosaur-speed-case","name":"Dinosaur runner: recovering one acceleration rule","name_zh":"恐龙跑酷：恢复一条加速规则","url":"https://github.com/morluto/rea/blob/c360cfcd6d7901514b16dd6113eba2e0b0fdf422/website/evidence/calculator-and-dino.md#dinosaur-speed","evidence_url":"https://github.com/morluto/rea/blob/c360cfcd6d7901514b16dd6113eba2e0b0fdf422/website/evidence/calculator-and-dino.md","description_en":"REA’s documented teaching case inspects the HTTP t-rex-runner edition and reconstructs its speed-update rule. A separate controlled original-game check and a new demonstration compare update counts, including the floating-point step that crosses the nominal speed threshold.","description_zh":"REA 的教学案例检查 HTTP 版 t-rex-runner，并重建其速度更新规则。单独进行的受控原游戏检查与新演示对比更新次数，包含浮点递增越过名义速度阈值的一步。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["game","website"],"verified_at":"2026-10-17"},{"id":"rea-calculator-percent-case","name":"Windows Calculator: reconstructing percentage rules","name_zh":"Windows Calculator：重建百分比规则","url":"https://github.com/morluto/rea/blob/c360cfcd6d7901514b16dd6113eba2e0b0fdf422/website/evidence/calculator-and-dino.md#windows-calculator","evidence_url":"https://github.com/morluto/rea/blob/c360cfcd6d7901514b16dd6113eba2e0b0fdf422/website/evidence/calculator-and-dino.md","description_en":"REA’s case traces the installed Windows Calculator model DLL to explain different percentage behavior for multiplication/division and other operations. An analyst-selected function is interpreted against public Microsoft source and demonstrated with fixed browser examples.","description_zh":"REA 案例追踪已安装 Windows Calculator 的模型 DLL，解释乘除运算与其他运算中不同的百分比行为。分析人员选定函数后，对照微软公开源码解释，并通过固定输入的浏览器示例演示。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["app","binary"],"verified_at":"2026-10-17"},{"id":"feishu-dual-instance-case","name":"Feishu: an author-reported isolated second app instance","name_zh":"飞书：作者报告的隔离第二应用实例","url":"https://benx.ai/blog/posts/rea-reverse-engineer-feishu-dual-instance/","evidence_url":"https://benx.ai/blog/posts/rea-reverse-engineer-feishu-dual-instance/","description_en":"The author reports using Codex and REA analysis to adapt a separate macOS Feishu copy with its own application identity, data directory and single-instance lock. The account describes local signing and separation checks while retaining the original app unchanged.","description_zh":"作者报告借助 Codex 与 REA 分析，修改独立的 macOS 飞书副本，为其设置不同的应用身份、数据目录和单实例锁。文章描述本地签名与隔离检查，并称原应用保持不变。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-17"},{"id":"zelda64recomp-case","name":"Zelda 64: Recompiled — a native Majora’s Mask port without a full source decompilation","name_zh":"Zelda 64: Recompiled：无需完整源码反编译的《姆吉拉的假面》原生移植","url":"https://github.com/Zelda64Recomp/Zelda64Recomp","evidence_url":"https://github.com/Zelda64Recomp/Zelda64Recomp/blob/b65c482ed672258eb684ab94a4e8c8aa662615ee/README.md","description_en":"Uses N64Recomp to translate Majora’s Mask into a native application and RT64 for rendering. The project separates static recompilation from source decompilation while reusing decompilation headers and selected functions for patches and enhancements.","description_zh":"通过 N64Recomp 将《姆吉拉的假面》转为原生应用，并使用 RT64 渲染。项目区分静态重编译与源码反编译，同时借用反编译项目的头文件和部分函数实现补丁与增强功能。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"opengoal-jak-case","name":"OpenGOAL: recovering GOAL code and rebuilding the Jak games","name_zh":"OpenGOAL：恢复 GOAL 代码并重建 Jak 系列游戏","url":"https://github.com/open-goal/jak-project","evidence_url":"https://github.com/open-goal/jak-project/blob/32c3cf73970f885c0a588623208232db72a74a58/README.md","description_en":"Reconstructs readable GOAL code from the original Jak binaries and compiles it with a new GOAL compiler for modern PCs. Its workflow combines a specialized decompiler, manually supplied type information, asset extraction and an interactive development runtime.","description_zh":"从 Jak 原二进制重建可读的 GOAL 代码，再用新编写的 GOAL 编译器为现代 PC 编译。流程结合专用反编译器、人工补充的类型信息、素材提取和交互式开发运行时。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"lego-island-decomp-case","name":"LEGO Island: source reconstruction with separately reported exact rebuilds","name_zh":"LEGO Island：源码重建与单独记录的精确重构建","url":"https://github.com/isledecomp/isle","evidence_url":"https://github.com/isledecomp/isle/blob/8119bd013645972c72480e4de21529f1e91ce5c7/README.md","description_en":"Reconstructs the English LEGO Island 1.1 source for its original 32-bit Windows target. The project distinguishes function-comparison reports, ReproBit’s reported byte-identical retail rebuilds and ordinary developer builds; its modern portable adaptation is a separate repository.","description_zh":"针对英文版 LEGO Island 1.1 的原始 32 位 Windows 目标重建源码。项目区分函数对比报告、ReproBit 报告的零售版逐字节一致重构建，以及普通开发构建；现代跨平台适配位于另一仓库。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"snowball-war-rea-case","name":"Snowball War: a bounded REA-assisted minigame reconstruction","name_zh":"Snowball War：范围明确的 REA 辅助小游戏重建","url":"https://github.com/tuunanet/rea-ski-or-die-reconstruction","evidence_url":"https://github.com/tuunanet/rea-ski-or-die-reconstruction/blob/0eac0671c90e21a16e663da7772b60710101ef7f/README.md","description_en":"The author uses REA’s Ghidra workflow to investigate the DOS Ski or Die binary, document Snowball War rules and rebuild that one minigame in Rust with SDL2. The public notes distinguish recovered tables and mechanics from approximations and deliberate presentation changes.","description_zh":"作者通过 REA 的 Ghidra 工作流调查 DOS 版 Ski or Die 二进制，记录 Snowball War 的规则，再用 Rust 与 SDL2 重建这一小游戏。公开笔记区分恢复的数据表和机制、近似实现以及有意调整的表现效果。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game"],"verified_at":"2026-10-17"},{"id":"space-cadet-pinball-case","name":"SpaceCadetPinball: decompiled game logic adapted to SDL2","name_zh":"SpaceCadetPinball：将反编译游戏逻辑适配到 SDL2","url":"https://github.com/k4zmu2a/SpaceCadetPinball","evidence_url":"https://github.com/k4zmu2a/SpaceCadetPinball/blob/cb9b7b886244a27773f66b0b19fdc2998392565e/README.md","description_en":"Converts the reverse-engineered Space Cadet pinball game into compilable C++ for desktop platforms. The README identifies the Windows XP executable and public PDB, a Full Tilt executable, and the work of recovering structures, naming variables and adapting the decompiled routines.","description_zh":"将逆向分析后的 Space Cadet 弹球游戏转为可编译的 C++，面向桌面平台。README 标明 Windows XP 可执行文件及公开 PDB、Full Tilt 可执行文件，并描述恢复结构、命名变量和适配反编译例程的工作。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"sm64-decomp-case","name":"Super Mario 64: ROM reconstruction with explicit comparison gates","name_zh":"Super Mario 64：带明确比较开关的 ROM 重建","url":"https://github.com/n64decomp/sm64","evidence_url":"https://github.com/n64decomp/sm64/blob/9921382a68bb0c865e5e45eb594d9c64db59b1af/README.md","description_en":"Reconstructs Super Mario 64 source for Japanese, North American, European, Shindou and iQue releases. Its build files distinguish original-ROM hash comparison from nonmatching or modified configurations, while source naming and documentation remain ongoing.","description_zh":"为日版、北美版、欧洲版、Shindou 版和 iQue 版 Super Mario 64 重建源码。构建文件区分原 ROM 哈希比较与非匹配或修改配置；源码命名和文档工作仍在推进。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"unleashed-recompiled-case","name":"Unleashed Recompiled: translating Xbox 360 game code and shaders","name_zh":"Unleashed Recompiled：转换 Xbox 360 游戏代码与着色器","url":"https://github.com/hedge-dev/UnleashedRecomp","evidence_url":"https://github.com/hedge-dev/UnleashedRecomp/blob/cf829a9eca8fb680fba4b0409ddeb6ca92f22e3c/README.md","description_en":"Builds an unofficial Sonic Unleashed PC port by statically recompiling Xbox 360 PowerPC code with XenonRecomp and Xenos shaders with XenosRecomp. The port adds modern display and modding options while documenting original-engine limits and remaining compatibility issues.","description_zh":"使用 XenonRecomp 静态重编译 Xbox 360 PowerPC 代码，并用 XenosRecomp 转换 Xenos 着色器，构建非官方 Sonic Unleashed PC 移植。项目增加现代显示与模组选项，同时记录原引擎限制和仍存在的兼容性问题。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"openmw-engine-case","name":"OpenMW: replacing Morrowind’s engine while reusing original content","name_zh":"OpenMW：复用原内容并替代 Morrowind 引擎","url":"https://github.com/OpenMW/openmw","evidence_url":"https://github.com/OpenMW/openmw/blob/5fdc0f1c4d1d07575f9b360b8cf1d6562232bf8e/README.md","description_en":"Provides an independent engine for playing Morrowind and an alternative editor, OpenMW-CS. It loads original game content through its own runtime and documents script and mod compatibility differences; it is an engine replacement rather than a recovered Bethesda source tree.","description_zh":"提供用于运行 Morrowind 的独立引擎和替代编辑器 OpenMW-CS，通过自己的运行时加载原游戏内容，并记录脚本及模组兼容性差异。这是引擎替代实现，而非恢复出的 Bethesda 源码树。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"redriver2-case","name":"REDRIVER2: reconstructing Driver 2 through a PlayStation compatibility layer","name_zh":"REDRIVER2：借助 PlayStation 兼容层重建 Driver 2","url":"https://github.com/OpenDriver2/REDRIVER2","evidence_url":"https://github.com/OpenDriver2/REDRIVER2/blob/b2d8857426f815007486def9bd23f9a6007a2c64/README.md","description_en":"Translates reverse-engineered Driver 2 MIPS routines into C/C++ and uses Psy-X/Psy-Cross to adapt PlayStation interfaces for desktop systems. The project documents symbol-assisted Ghidra/IDA work alongside intentional bug fixes and gameplay changes.","description_zh":"将逆向分析的 Driver 2 MIPS 例程转为 C/C++，并用 Psy-X/Psy-Cross 将 PlayStation 接口适配到桌面系统。项目记录借助符号的 Ghidra/IDA 分析，同时明确包含有意修复的错误和玩法改动。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"photocraft-case","name":"PhotoCraft: editor workflow reconstruction and PSD round-trip boundaries","name_zh":"PhotoCraft：编辑流程重建与 PSD 往返边界","url":"https://github.com/storytold/photocraft","evidence_url":"https://github.com/storytold/photocraft/blob/5f65579ecb44047c2a619036c18ff273202e1389/README.md","description_en":"The authors describe this Rust image editor as a clean-room reimplementation of Photoshop-style workflows. Its document engine, UI and automation interfaces share editing commands, while the source distinguishes PSD editor round trips from byte preservation in the standalone file codec.","description_zh":"作者将这款 Rust 图像编辑器描述为 Photoshop 风格流程的净室重实现。文档引擎、界面与自动化接口共用编辑命令；源码区分编辑器中的 PSD 往返处理与独立文件编解码器的字节保留。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-17"},{"id":"wordcraft-case","name":"WordCraft: document workflow reconstruction and bounded DOCX compatibility","name_zh":"WordCraft：文档流程重建与有限范围 DOCX 兼容","url":"https://github.com/storytold/wordcraft","evidence_url":"https://github.com/storytold/wordcraft/blob/eae242176108d328c5dd81fbc10370c51ab90706/README.md","description_en":"The authors describe WordCraft as a clean-room Rust implementation of familiar Microsoft Word workflows. It provides its own document model, layout engine and DOCX reader/writer, with desktop and browser interfaces; source tests exercise selected editing and file-preservation behavior.","description_zh":"作者将 WordCraft 描述为以 Rust 净室重实现熟悉的 Microsoft Word 流程。项目提供自己的文档模型、排版引擎和 DOCX 读写器，以及桌面与浏览器界面；源码测试覆盖选定的编辑与文件保留行为。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-17"},{"id":"gridcraft-case","name":"GridCraft: spreadsheet workflow reconstruction and XLSX round-trip limits","name_zh":"GridCraft：电子表格流程重建与 XLSX 往返边界","url":"https://github.com/storytold/gridcraft","evidence_url":"https://github.com/storytold/gridcraft/blob/f1894c6da64d4326022ae644c767581816a23c2c/README.md","description_en":"The authors describe GridCraft as a clean-room Rust implementation of Excel-style spreadsheet workflows. A workbook model, formula parser and dependency-driven recalculation are connected to XLSX I/O and a shared editing-command layer for desktop, browser and automation interfaces.","description_zh":"作者将 GridCraft 描述为以 Rust 净室重实现 Excel 风格的电子表格流程。工作簿模型、公式解析器与依赖驱动的重新计算连接到 XLSX 读写，以及供桌面、浏览器和自动化接口共用的编辑命令层。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-17"},{"id":"deckcraft-case","name":"DeckCraft: presentation workflow reconstruction and bounded PPTX interchange","name_zh":"DeckCraft：演示文稿流程重建与有限范围 PPTX 交换","url":"https://github.com/storytold/deckcraft","evidence_url":"https://github.com/storytold/deckcraft/blob/1dc69720db64323370dda061226becb09ad79fd4/README.md","description_en":"The authors describe DeckCraft as a clean-room Rust implementation of PowerPoint-style presentation workflows. Its slide model, rendering and command layers support desktop/browser editing and PPTX interchange; reviewed source tests check constructed decks and selected preserved package parts.","description_zh":"作者将 DeckCraft 描述为以 Rust 净室重实现 PowerPoint 风格的演示文稿流程。其幻灯片模型、渲染与命令层支撑桌面／浏览器编辑及 PPTX 交换；所审阅源码测试检查构造的文稿和选定的保留包部件。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-17"},{"id":"devilutionx-case","name":"DevilutionX: porting Diablo’s reconstructed engine","name_zh":"DevilutionX：移植重建后的 Diablo 引擎","url":"https://github.com/diasurgical/DevilutionX","evidence_url":"https://github.com/diasurgical/DevilutionX/blob/94433061f847d22863e5d705c398f7c13d7bab85/README.md","description_en":"Builds a modern Diablo and Hellfire port on the Devilution reconstruction, with platform support, bug fixes and optional quality-of-life features. The project documents the original symbol-assisted reconstruction and includes selected dungeon-generation and saved-game regression checks.","description_zh":"基于 Devilution 重建成果提供现代平台上的 Diablo 与 Hellfire 移植，加入平台支持、错误修复及可选便利功能。项目记录了早期借助符号信息的重建过程，并包含特定地牢生成与存档回归检查。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"thinkpad-imx471-camera-case","name":"ThinkPad IMX471: recovering camera tuning for Linux","name_zh":"ThinkPad IMX471：为 Linux 恢复相机调校信息","url":"https://github.com/cschalle/mipi-fixes-x1-aura","evidence_url":"https://github.com/cschalle/mipi-fixes-x1-aura/blob/533d995b7acbd6965e5b0b85c97f8bafab9fed4e/README.md","description_en":"Recovers selected camera-tuning structures from an Intel Windows driver package and uses them to repair Linux image capture on one ThinkPad model. Public CPFF/AIQB parsers, kernel patches and libcamera changes accompany the author’s Claude-assisted investigation and bounded before/after measurements.","description_zh":"从 Intel Windows 驱动包中恢复选定的相机调校结构，用于修复一个 ThinkPad 型号在 Linux 下的图像采集。公开的 CPFF／AIQB 解析器、内核补丁及 libcamera 修改，配有作者报告的 Claude 辅助调查和有限范围的前后测量。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-10-17"},{"id":"ledger-reborn-accounting-case","name":"Ledger Reborn: an independent accounting app informed by QuickBooks study","name_zh":"Ledger Reborn：基于 QuickBooks 研究的独立记账实现","url":"https://github.com/lxistired/ledger-reborn","evidence_url":"https://github.com/lxistired/ledger-reborn/blob/d7f6b8a1f4ad6c4ae8b10100d1c93cf15940c21d/docs/CASE_STUDY.md","description_en":"The maintainer reports using REA and Ghidra to study selected QuickBooks Desktop for Mac behavior, then independently implements a local accounting application. Its Python/SQLite engine persists double-entry journals, invoices, inventory and payments, while public synthetic fixtures test bounded accounting and rollback behavior.","description_zh":"维护者报告使用 REA 与 Ghidra 研究 QuickBooks Desktop for Mac 的选定行为，随后独立实现本地记账应用。Python／SQLite 引擎持久保存复式分录、发票、库存和付款；公开合成样例检查有限范围的记账与回滚行为。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-17"},{"id":"rauchg-rsc-reconstruction-case","name":"rauchg.com: rebuilding an RSC blog from captured Flight output","name_zh":"rauchg.com：根据捕获的 Flight 输出重建 RSC 博客","url":"https://github.com/boyang-hu/website-rebuild-skill/blob/ac60c9d8a2ab40045a89b5403c3457f1404e92b3/skills/website-rebuild/references/rsc-reconstruction.md","evidence_url":"https://github.com/boyang-hu/website-rebuild-skill/blob/ac60c9d8a2ab40045a89b5403c3457f1404e92b3/skills/website-rebuild/references/rsc-reconstruction.md","description_en":"Documents a website-rebuild-skill case that decodes browser-delivered React Server Component Flight streams, reconstructs a buildable Next project and compares its output with a captured site. The reported rauchg.com campaign uses route-tree comparison and module-reference mapping; the new server source is inferred from observable output.","description_zh":"记录 website-rebuild-skill 的一个案例：解码浏览器收到的 React 服务端组件 Flight 流，重建可构建的 Next 项目，再与捕获站点的输出比较。作者报告的 rauchg.com 重建过程采用路由树比较与模块引用映射；新服务端源码由可观察输出推断。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["website"],"verified_at":"2026-10-17"},{"id":"njfe-ear-camera-bridge-case","name":"NJFE: a Soulear camera protocol bridge for desktop inspection","name_zh":"NJFE：用于电脑检查的 Soulear 相机协议桥接","url":"https://github.com/WildweaselMS/NJFE","evidence_url":"https://github.com/WildweaselMS/NJFE/blob/992866c6609f8c813f459ff79840cf04d5883f8e/README.md","description_en":"Reuses otoscope's reverse-engineered i4season/Soulear protocol in an ESP32-C3 bridge and Python desktop viewer. The author credits Claude Code for implementation and reports streaming one Hopefox Find T to a Windows PC, with recording, orientation and LED controls.","description_zh":"在 ESP32-C3 桥接器与 Python 电脑查看器中复用 otoscope 经逆向得到的 i4season／Soulear 协议。作者将实现归功于 Claude Code 辅助，报告把一台 Hopefox Find T 的视频传到 Windows 电脑，并提供录像、方向调整及 LED 控制。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"baocut-slides-editor-case","name":"BaoCut Slides: adapting an interactive web editor","name_zh":"BaoCut Slides：交互式网页编辑器改编","url":"https://github.com/JimLiu/baocut/tree/b8585e0c8d7a82bdee9f0ed019cf6edb075e41c1/packages/slides-runtime","evidence_url":"https://github.com/JimLiu/baocut/blob/b8585e0c8d7a82bdee9f0ed019cf6edb075e41c1/docs/design/slides/slides-design.md","description_en":"Documents BaoCut’s interactive slide editor, whose author says the implementation draws on Claude Slides. It adds a local deck store, HTML/CSS compiler and annotation-to-agent bridge for browser and desktop hosts; the design reports a Web-flow check, without establishing original backend recovery or full behavioral parity.","description_zh":"记录 BaoCut 交互式幻灯片编辑器，作者称其实现借鉴自 Claude Slides。它为浏览器与桌面宿主加入本地文稿存储、HTML/CSS 编译器及标注到智能体的桥接；设计说明报告了 Web 流程检查，但未确立原有后端恢复或完整行为一致性。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","website"],"verified_at":"2026-10-17"},{"id":"pocket-tasks-reconstruction-case","name":"Pocket Tasks: reconstructing task state and persistence","name_zh":"Pocket Tasks：重建任务状态与持久保存行为","url":"https://github.com/ShadowSwaps/REA-Reconstruction-Companion/tree/main/evals/reference/reconstruction","evidence_url":"https://github.com/ShadowSwaps/REA-Reconstruction-Companion/blob/590e65dd99596c7fb66598eaa5d6c051c2ec9a5f/evals/reference/reconstruction/README.md","description_en":"A teaching case with disclosed prior source access carries a REA-assisted investigation of a small command-line app into a separate Node implementation. It preserves observed task editing, persistence and selection behavior, then compares scoped outputs against fixed expectations and captured reference sessions.","description_zh":"此教学案例明确披露作者先前接触过源码，将一次 REA 辅助的小型命令行应用调查推进为另行编写的 Node 实现。它保留所观察到的任务编辑、持久保存及选择行为，再将限定范围的输出与固定期望值及捕获的参考会话比较。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-17"},{"id":"open-scrantic-screensaver-case","name":"Open Scrantic: reconstructing the Johnny Castaway screensaver engine","name_zh":"Open Scrantic：重建 Johnny Castaway 屏幕保护程序引擎","url":"https://github.com/glauberlima/open-scrantic","evidence_url":"https://github.com/glauberlima/open-scrantic/blob/2db75008931eb744f79d0c3fb12e0d89950466ff/README.md","description_en":"Reconstructs the Johnny Castaway screensaver engine in Rust, with author-disclosed REA and Claude Code use. It reads original files to run recovered animation scripts and calendar-based story state on modern desktops; documented deviations and limited tests stop short of complete behavioral equivalence.","description_zh":"以 Rust 重建 Johnny Castaway 屏幕保护程序引擎，作者明确披露使用 REA 与 Claude Code。它读取原始文件，在现代桌面上运行恢复的动画脚本及按日历推进的故事状态；文档保留实现差异与有限测试范围，未确立完整行为等价。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-18"},{"id":"eleven-agent-re-workbench","name":"Eleven","name_zh":"Eleven","url":"https://github.com/Zfinix/eleven","evidence_url":"https://github.com/Zfinix/eleven/blob/94760718dfd741ba93fcc9b591eb39a96c034103/README.md","description_en":"An agent-first desktop reverse-engineering app that opens Mach-O, ELF and PE binaries, Android packages and GPU kernels, and lets any Agent Client Protocol agent read code, rename functions, add notes and propose patches in a shared window. Native code is decompiled by Ghidra through a bundled REA build, with Rizin and jadx as alternative engines. It is a workbench around existing engines, not a new decompiler or a reconstruction case.","description_zh":"以智能体为核心的桌面逆向工程应用，可打开 Mach-O、ELF、PE 二进制、Android 安装包和 GPU 内核，让任何支持 Agent Client Protocol 的智能体在同一窗口中阅读代码、重命名函数、添加笔记并提出补丁。原生代码通过内置的 REA 构建交由 Ghidra 反编译，也可改用 Rizin 和 jadx。它是围绕现有引擎的工作台，并非新的反编译器或重建案例。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["app","binary"],"verified_at":"2026-10-18"},{"id":"rea-flutter-guide","name":"Flutter build identification","name_zh":"Flutter 构建识别","url":"https://github.com/morluto/rea/blob/main/docs/flutter-analysis.md","evidence_url":"https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/docs/flutter-analysis.md","description_en":"Identifies a Flutter APK’s Dart snapshot hash, per-ABI library digests and engine build provenance, then inspects one ABI’s AOT snapshot sections, through REA’s pure-parsing CLI and MCP tools. The string-pool output is a bounded byte-pattern projection of package and SDK URIs, not deserialized Dart classes or recovered source.","description_zh":"通过 REA 的纯解析命令行与 MCP 工具，识别 Flutter APK 的 Dart 快照哈希、各 ABI 库摘要与引擎构建来源，再检查单个 ABI 的 AOT 快照段。字符串池输出是对 package 与 SDK URI 的有界字节模式投影，并非反序列化的 Dart 类或恢复的源码。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["app"],"verified_at":"2026-10-18"},{"id":"rea-harmony-guide","name":"Static HarmonyOS package inventory","name_zh":"HarmonyOS 应用包静态清点","url":"https://github.com/morluto/rea/blob/main/docs/harmony-analysis.md","evidence_url":"https://github.com/morluto/rea/blob/093ce695f0a7c3407c7fde520ed8b20c0981b408/docs/harmony-analysis.md","description_en":"Inventories HarmonyOS HAP, HSP and App Pack files through REA’s hardened ZIP reader and projects an execution-free application graph: component paths, IDs and hashes, Stage/FA packaging hints, runtime-family hints and path-based native-bridge hypotheses. Every claim rests on path presence; manifests, Ark bytecode, resources and signatures are not decoded or verified.","description_zh":"通过 REA 加固的 ZIP 读取器清点 HarmonyOS 的 HAP、HSP 与 App Pack 文件，并投影出无需执行的应用图：组件路径、ID 与哈希、Stage／FA 打包模型提示、运行时类别提示，以及基于路径的原生桥接假设。所有结论仅基于路径存在；清单、Ark 字节码、资源和签名均未被解码或验证。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["app"],"verified_at":"2026-10-18"},{"id":"rea-ghidra-mips-guide","name":"MIPS ELF analysis through Ghidra","name_zh":"通过 Ghidra 分析 MIPS ELF","url":"https://github.com/morluto/rea/blob/main/docs/ghidra-mips.md","evidence_url":"https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/docs/ghidra-mips.md","description_en":"Documents REA’s Ghidra lane for MIPS ELF executables, relocatable objects and MIPS16 shared images, including a pinned 32-bit language for recordless legacy firmware executables that Ghidra would otherwise import as 64-bit. Admission is bounded by declared header and ABI-record facts, and verification compares source-owned fixtures with independent readelf output rather than executing or rehosting firmware.","description_zh":"说明 REA 通过 Ghidra 分析 MIPS ELF 可执行文件、可重定位目标文件与 MIPS16 共享镜像的流程，包括为缺少 ABI 记录的旧式固件可执行文件固定 32 位语言，以免 Ghidra 将其按 64 位导入。准入以文件头声明和 ABI 记录为界；验证将项目自有的测试样本与独立的 readelf 输出对照，而不执行或重新托管固件。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["binary","firmware"],"verified_at":"2026-10-18"},{"id":"rea-ghidra-psp-guide","name":"PSP static ELF analysis through Ghidra","name_zh":"通过 Ghidra 静态分析 PSP ELF","url":"https://github.com/morluto/rea/blob/main/docs/ghidra-psp.md","evidence_url":"https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/docs/ghidra-psp.md","description_en":"Documents REA’s bounded Ghidra profile for static PSP ELF executables, which leaves Allegrex instructions, PSP loading and calling conventions to a caller-installed ghidra-allegrex extension while reusing REA’s CLI, MCP, Evidence and snapshot workflows. It admits one PSPSDK header and ABI declaration on Linux x64 and verifies selected static facts on a self-built fixture, not commercial games or PRX modules.","description_zh":"说明 REA 针对静态 PSP ELF 可执行文件的受限 Ghidra 配置：Allegrex 指令、PSP 加载与调用约定交由使用者安装的 ghidra-allegrex 扩展处理，同时沿用 REA 的命令行、MCP、证据与快照流程。它仅在 Linux x64 上接受一种 PSPSDK 文件头与 ABI 声明，并在自行构建的测试样本上验证选定的静态事实，不涉及商业游戏或 PRX 模块。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"rea-touhou-reconstruction-method-case","name":"Touhou reconstructions: an agent-driven method across three games","name_zh":"东方 Project 重建：贯穿三款游戏的智能体驱动方法","url":"https://rea.tools/blog/touhou-reconstruction/","evidence_url":"https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/website/evidence/touhou-reconstruction-method.md","description_en":"An essay published on REA’s site, with pinned evidence notes, describes one author’s agent-driven reconstructions of TH08, TH095 and TH04. It dates milestones from public commits and progress ledgers, separates exact-comparison and playable-build oracles, and documents a TH08 check that missed wrong floating-literal data. Project results remain author-reported, and REA is credited with supplying analysis evidence, not the reconstructions themselves.","description_zh":"REA 网站发表的一篇文章及其固定版本的证据说明，介绍一位作者以智能体驱动重建 TH08、TH095 与 TH04 的过程。文章依据公开提交与进度记录标注里程碑，区分精确比对与可游玩构建两类判定依据，并记录 TH08 一项检查漏查错误浮点字面量数据的问题。项目结果仍为作者报告；REA 的作用是为智能体提供分析证据，而非完成重建本身。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"rea-engine-tictactoe-case","name":"TicTacToe-AI: a bounded REA-fork reconstruction of one game method","name_zh":"TicTacToe-AI：REA 分叉对单个游戏方法的有限重建","url":"https://github.com/heaven-hm/re-agent/tree/develop/benchmarks/tictactoe","evidence_url":"https://github.com/heaven-hm/re-agent/blob/a84c61e8baa65d445485722420a57ff4132b90d3/benchmarks/native-windows-ports/reports/targets/tictactoe.md","description_en":"The author’s REA fork, posted as rea-engine and since renamed RE-Agent, decompiles the shipped .NET executable of the GPL-licensed TicTacToe-AI game, recompiles the recovered C# and resources, and repairs one decompiler error against the original IL. A differential probe runs original and rebuilt code on all 19,683 board assignments for one status method and compares six form renders. The report passes only that method; the whole game remains partial.","description_zh":"作者的 REA 分叉（发帖时名为 rea-engine，后更名为 RE-Agent）反编译 GPL 许可的 TicTacToe-AI 游戏所发布的 .NET 可执行文件，重新编译恢复出的 C# 与资源，并依据原始 IL 修复一处反编译错误。差分探针在一个状态判定方法的全部 19,683 种棋盘赋值上运行原版与重建代码，并比较六张窗体渲染图。报告只判定该方法通过，整个游戏仍属部分重建。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game"],"verified_at":"2026-10-18"},{"id":"rea-claude-code-isolated-ab-case","name":"REA in Claude Code: an isolated static-analysis A/B trial","name_zh":"Claude Code 中的 REA：隔离配置下的静态分析 A/B 试验","url":"https://zenn.dev/keigoly/articles/8738d8d241b5a1","evidence_url":"https://zenn.dev/keigoly/articles/8738d8d241b5a1","description_en":"A Japanese field report connects REA 6.4.0 to Claude Code in a separate project directory, denies 43 of its 170 tools and common shell launch forms, and compares REA-enabled and REA-disabled runs on two real tasks: an Electron terminal’s packaged files and a saved HAR capture. Both arms answered correctly, while the REA arm took up to 2.00× the time and 1.67× the API-equivalent cost. It is an analysis-evaluation and safety-configuration case, not a reconstruction.","description_zh":"一篇日文实践报告在单独的项目目录中把 REA 6.4.0 接入 Claude Code，屏蔽其 170 个工具中的 43 个以及常见的命令行启动方式，并在两个真实任务上比较启用与禁用 REA 的运行：一个 Electron 终端的分发文件，以及一份保存的 HAR 通信记录。两组都给出正确答案，而启用 REA 的一组耗时最多为 2.00 倍、按 API 计价的费用最多为 1.67 倍。这是分析评估与安全配置案例，而非重建案例。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app","website"],"verified_at":"2026-10-18"},{"id":"rea-ghidra-nativeaot-guide","name":"NativeAOT metadata recovery with Ghidra","name_zh":"借助 Ghidra 恢复 NativeAOT 元数据","url":"https://github.com/morluto/rea/blob/main/docs/ghidra-nativeaot.md","evidence_url":"https://github.com/morluto/rea/blob/093ce695f0a7c3407c7fde520ed8b20c0981b408/docs/ghidra-nativeaot.md","description_en":"Recovers .NET 8 NativeAOT metadata from x64 PE executables during REA’s Ghidra analysis: MethodTable relationships, virtual slots and frozen strings from RTR 9.1 data, through a built-in read-only parser or an optional headless adapter that annotates the Ghidra database. Generated names, inferred prototypes and recovered native pseudocode stay separate from the unknown original C# names, fields and source.","description_zh":"在 REA 的 Ghidra 分析中，从 x64 PE 可执行文件恢复 .NET 8 NativeAOT 元数据：通过内置只读解析器或可选的无界面适配器（会为 Ghidra 数据库添加注释），从 RTR 9.1 数据中取得 MethodTable 关系、虚表槽位与冻结字符串。生成的名称、推断的原型和恢复的原生伪代码，与未知的原始 C# 名称、字段和源码明确区分。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["binary"],"verified_at":"2026-10-18"},{"id":"ultrasunnymoon-rea-case","name":"UltraSunnyMoon: a partial, REA-led Pokémon Ultra Sun reconstruction","name_zh":"UltraSunnyMoon：以 REA 主导的部分《宝可梦 究极之日》重建","url":"https://github.com/tylergraydev/UltraSunnyMoon","evidence_url":"https://github.com/tylergraydev/UltraSunnyMoon/blob/913eed4969163ea15e354dacb8e2bfe0a2439de5/README.md","description_en":"The author uses a pinned REA build with Ghidra to analyze a user-supplied Pokémon Ultra Sun base executable, rebuild it byte for byte from split objects, and swap in two small compiled C runtime routines. Both replacements are behavior-tested but nonmatching and every other byte stays original; one recorded input movie drives the original and hybrid builds to the same bedroom movement in the Azahar emulator. Retail compiler identity, exact matching, module loading and broader gameplay remain open.","description_zh":"作者使用固定版本的 REA 与 Ghidra，分析使用者自备的《宝可梦 究极之日》基础版可执行文件，由拆分出的对象逐字节重建该文件，并替换进两个编译后的小型 C 运行时例程。两处替换均经行为测试但与原字节不一致，其余字节均保持原样；同一段录制输入在 Azahar 模拟器中让原版与混合构建到达相同的卧室移动场景。零售编译器识别、精确匹配、模块加载及更广泛的游戏行为仍待解决。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game"],"verified_at":"2026-10-18"},{"id":"reversed-with-ai-directory","name":"Reversed with AI","name_zh":"Reversed with AI：AI 辅助逆向项目目录","url":"https://reversedwithai.com/","evidence_url":"https://reversedwithai.com/about","description_en":"A moderated website directory of AI-assisted reverse-engineering projects across games, firmware, file formats, APIs and protocols, apps and legacy software. Each entry links to its primary source and records the author-reported model, tools, time, cost and outcome, with four checks for public source, reproduction steps, real-hardware testing and third-party confirmation.","description_zh":"经人工审核的网站目录，收录游戏、固件、文件格式、API 与协议、应用及旧软件领域的 AI 辅助逆向项目。每个条目链接一手来源，记录作者报告的模型、工具、耗时、费用与结果，并标注源码公开、复现步骤、真实硬件测试和第三方确认四项检查。","kind":"collection","category":"related-lists","group":"learn","relationship":"community-learning-resource","targets":["app","binary","firmware","game","protocol"],"verified_at":"2026-10-18"},{"id":"hermes-rea-plugin","name":"REA plugin for Hermes Agent","name_zh":"Hermes Agent 的 REA 插件","url":"https://github.com/NousResearch/hermes-official-plugins/tree/main/rea","evidence_url":"https://github.com/NousResearch/hermes-official-plugins/blob/6dacaaddbfd8e98dfc524096c44f712f743246b8/rea/README.md","description_en":"Nous Research’s Hermes Agent plugin package for REA. One catalog install registers REA’s MCP server, pinned to rea-agents 6.4.0 and launched through npx over stdio, with REA’s workflow skill adapted for Hermes and a separate crash-triage skill. About 170 REA tools stay behind Hermes’ on-demand tool search, and the adapted skill asks before tools that run programs, drive apps or change a connected Android device.","description_zh":"Nous Research 在 Hermes Agent 官方插件库中发布的 REA 插件包。一次目录安装即可注册 REA 的 MCP 服务（固定为 rea-agents 6.4.0，经 npx 以 stdio 启动），并附带为 Hermes 改编的 REA 工作流技能和独立的崩溃分诊技能。约 170 个 REA 工具通过 Hermes 的按需工具检索提供；改编技能要求在运行程序、驱动应用或改动已连接 Android 设备的工具前先征得同意。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["app","binary","firmware","website"],"verified_at":"2026-10-18"},{"id":"crashlens-rea-crash-triage","name":"crashlens","name_zh":"crashlens 崩溃分诊工具","url":"https://github.com/mingleiw/crashlens","evidence_url":"https://github.com/mingleiw/crashlens/blob/7188611a506e058a8f4937acf3dfd3035545f2d1/README.md","description_en":"A crash-triage tool that turns Linux core dumps, runtime panics, exception traces and sanitizer reports into Markdown bug reports naming the crash type, the first frame in the user’s code and a stable signature. Its core-dump path calls the REA CLI to read the recorded crash and the binary layout, and can ask REA’s Ghidra provider for pseudocode of stripped functions; a Claude Code plugin bundles a skill and read-only MCP tools. It is a debugging integration around REA, not a reconstruction case, and its diagnostic accuracy remains author-reported.","description_zh":"崩溃分诊工具，将 Linux 核心转储、运行时 panic、异常堆栈和 sanitizer 报告整理为 Markdown 缺陷报告，指出崩溃类型、首个用户代码帧和稳定签名。核心转储分析通过 REA 命令行读取崩溃记录与二进制布局，并可调用 REA 的 Ghidra 引擎为无符号函数生成伪代码；附带的 Claude Code 插件包含技能与只读 MCP 工具。它是围绕 REA 的调试集成，不是重建案例，诊断准确性仍为作者报告。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["binary"],"verified_at":"2026-10-18"},{"id":"rea-dino-runner-community-case","name":"Dinosaur runner: an REA-inspected speed rule rebuilt with Codex","name_zh":"恐龙跑酷：经 REA 检查、由 Codex 重建的速度规则","url":"https://github.com/zhxunzh84/rea-dino-reverse-engineering","evidence_url":"https://github.com/zhxunzh84/rea-dino-reverse-engineering/blob/1fa0ae9faae97d65754f2abf89d3e8326aea9525/README.md","description_en":"The author uses REA’s MCP browser tools to passively capture the JavaScript loaded by wayou’s open-source T-Rex Runner page, then has Codex rebuild its acceleration rule in one self-contained HTML5 Canvas game. The report identifies the captured script by SHA-256 and separates verified source facts from reconstruction choices; only the speed rule is claimed, not full gameplay equivalence.","description_zh":"作者使用 REA 的 MCP 浏览器工具被动捕获 wayou 开源 T-Rex Runner 页面已加载的 JavaScript，再由 Codex 在一个自包含的 HTML5 Canvas 游戏中重建其加速规则。报告以 SHA-256 标识所捕获的脚本，并区分已核实的源码事实与重建选择；只主张速度规则一致，不主张完整玩法等价。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game","website"],"verified_at":"2026-10-18"},{"id":"screen-studio-auto-zoom-case","name":"Screen Studio: an author-reported REA study of auto-zoom rules","name_zh":"Screen Studio：作者报告的 REA 自动缩放规则研究","url":"https://x.com/i/article/2109834677343432704","evidence_url":"https://x.com/i/article/2109834677343432704","description_en":"The author reports using REA to map Screen Studio’s Electron package, reading six auto-zoom and cursor rules from its obfuscated code with Claude Code’s help, and having Claude Code write an independent recorder and renderer from those rules. The article describes the commands, evidence, a cursor-alignment check and the clone’s gaps; neither the clone nor the decoded code is published.","description_zh":"作者报告借助 REA 梳理 Screen Studio 的 Electron 安装包，在 Claude Code 协助下从混淆代码中读出六条自动缩放与光标规则，再让 Claude Code 依据这些规则编写独立的录屏和渲染程序。文章介绍了所用命令、证据、光标对齐检查以及复刻版的不足；复刻版和解出的代码均未公开。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-18"},{"id":"claude-code-background-lab-case","name":"Claude Code background lab: an REA-informed reimplementation of a desktop animation","name_zh":"Claude Code 背景动画实验室：基于 REA 调查的桌面动画重新实现","url":"https://github.com/Henry-fan88/claude-code-background","evidence_url":"https://github.com/Henry-fan88/claude-code-background/blob/3dbd1065835508be6027137927deeddb8c30fe55/docs/PROVENANCE.md","description_en":"Reimplements the glyph-wind background of the Claude desktop app’s Claude Code New session view as an offline WebGL2 page with a 38-slider control panel. The author reports a static REA investigation of the desktop shell and its remote web bundle, followed by a newly written renderer that reuses recovered timing and layout values. It shares the original’s visual vocabulary and interaction model but is not a pixel-identical extraction.","description_zh":"将 Claude 桌面应用中 Claude Code“新会话”界面的字符风场背景，重新实现为可离线运行的 WebGL2 页面，并附带 38 个滑块的控制面板。作者报告先用 REA 对桌面外壳及其远程网页包进行静态调查，再以新编写的渲染器复用恢复出的时序与布局参数。它与原效果的视觉语言和交互方式相近，但不是逐像素一致的提取。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-18"},{"id":"dx-ball-rea-reconstruction-case","name":"DX-Ball: an REA-guided function-level reconstruction with Codex","name_zh":"DX-Ball：借助 REA 并由 Codex 完成的函数级重建","url":"https://github.com/N0zoM1z0/dx-ball","evidence_url":"https://github.com/N0zoM1z0/dx-ball/blob/d1251ea4bd000c7204c895c029194cae1d269731/README.md","description_en":"The author has Codex use REA’s Ghidra tools to inspect the English DX-Ball 1.07 executable and recover it as typed C/C++, then compiles each function with the original-era Visual C++ 4.0 and compares it byte for byte with the original after mapping relocations. The same source also builds a MinGW Windows game and a portable core library. Exact reconstruction is still in progress; REA’s separate sound-pan showcase covers just one function.","description_zh":"作者让 Codex 通过 REA 的 Ghidra 工具检查英文版 DX-Ball 1.07 可执行文件并恢复为带类型的 C/C++，再用同时代的 Visual C++ 4.0 编译每个函数，在映射重定位后与原文件逐字节比较。同一套源码还可构建 MinGW Windows 游戏和可移植核心库。精确重建仍在进行中；REA 另行发布的声像展示只覆盖其中一个函数。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"re2ds-nds-engine-case","name":"re2ds: a native Nintendo DS engine for Resident Evil 2","name_zh":"re2ds：Resident Evil 2 的原生 Nintendo DS 引擎","url":"https://github.com/eray1605/re2ds","evidence_url":"https://github.com/eray1605/re2ds/blob/f1e120ec50f6b072d7283a2d3dd35611d656c9b7/README.md","description_en":"Reimplements Resident Evil 2’s PS1 game rules in a native Nintendo DS engine, with converters that turn data from the user’s own disc into DS formats. A helper wraps the PS1 executable as an ELF for REA’s Ghidra lane, analysis notes name the PS1 functions and tables each part follows, and the Reddit post linking it credits REA and Claude Code. Leon’s disc 1 is reported playable, while Claire’s disc, most enemy types and some menus remain unfinished.","description_zh":"在原生 Nintendo DS 引擎中重新实现 Resident Evil 2 PS1 版的游戏规则，并用转换工具把使用者自有光盘中的数据转为 DS 格式。辅助脚本把 PS1 可执行文件包装成 ELF，供 REA 的 Ghidra 通道分析；分析笔记注明各部分所依据的 PS1 函数与数据表，链接该项目的 Reddit 帖称其借助 REA 和 Claude Code 完成。据报告 Leon 第一张光盘已可游玩，Claire 光盘、多数敌人类型和部分菜单仍未完成。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game"],"verified_at":"2026-10-18"},{"id":"rea-workspace-template","name":"REA Workspace Template","name_zh":"REA 工作区模板","url":"https://github.com/dobest1024/rea-workspace-template","evidence_url":"https://github.com/dobest1024/rea-workspace-template/blob/fc15b9a4ba2a8b40510d19a2dd80209f665711c5/README.md","description_en":"A clone-first Chinese workspace template for analyzing one target per workspace with REA from Claude Code or Codex. It ships project-level REA MCP settings, agent rules that require CONFIRMED/GUESS labels with evidence locations, seven task prompts and standard-library scripts that hash imported originals, stage writable copies and strip values from HAR captures. It organizes analysis rather than performing it, and its acceptance run used only synthetic samples.","description_zh":"一个可直接克隆的中文工作区模板，用于在 Claude Code 或 Codex 中借助 REA，按“一个目标一个工作区”开展分析。它提供项目级 REA MCP 配置、要求结论标注 CONFIRMED／GUESS 并附证据位置的智能体规则、七套任务提示词，以及仅依赖标准库的脚本：为导入的原件生成哈希基线、创建可写分析副本，并去除 HAR 抓包中的取值。它负责组织分析而非完成分析，其验收只使用了合成样本。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["app","binary","website"],"verified_at":"2026-10-19"},{"id":"rea-reconstruction-companion","name":"REA Reconstruction Companion","name_zh":"REA Reconstruction Companion 重建配套技能","url":"https://github.com/ShadowSwaps/REA-Reconstruction-Companion","evidence_url":"https://github.com/ShadowSwaps/REA-Reconstruction-Companion/blob/9daa5c8b3b8871fd643df636413f7d9e74520669/README.md","description_en":"A third-party Agent Skill that works alongside REA’s own skill to turn reverse-engineering evidence into scoped requirements, design, staged implementation and validation, from one feature or format to a whole app. An optional installer can add a marked routing block to the user’s REA SKILL.md so that relevant reconstruction requests load both skills. Its bundled evaluation kit consists of source-exposed, maintainer-authored examples with literal oracles, not a model benchmark.","description_zh":"第三方 Agent Skill，与 REA 自身的技能配合使用，把逆向分析证据整理成限定范围的需求、设计、分阶段实现与验证，范围可从单个功能或格式扩展到整个应用。可选安装程序能在用户的 REA SKILL.md 中加入带标记的路由段落，使相关重建请求同时加载两个技能。附带的评估套件由维护者编写、已接触源码的示例及字面预期值组成，并非模型基准。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["app","binary"],"verified_at":"2026-10-18"},{"id":"noflag-rea-evidence-architecture-study","name":"Show Your Work: a measured dissection of REA's evidence architecture","name_zh":"Show Your Work：对 REA 证据架构的实测剖析","url":"https://no-flag.com/2026/10/18/REA-paper/","evidence_url":"https://no-flag.com/2026/10/18/REA-paper/","description_en":"An unofficial field study that reads REA's source and then drives the running server through 1,012 recorded calls across 27 artifact classes, measuring its content-addressed Evidence records, revision-chained unknown ledger, typed refusals, cold starts and response limits. The author maps those mechanisms onto vulnerability-research agents as an argument for not overclaiming. It evaluates REA's tool surface; it is not a reconstruction or a vulnerability finding.","description_zh":"一篇非官方的实测研究：先阅读 REA 源码，再在 27 类分析对象上对运行中的服务器发出 1,012 次有记录的调用，测量其按内容寻址的 Evidence 记录、按修订串联的未知项台账、带类型的拒绝、冷启动及响应上限。作者把这些机制对应到漏洞研究智能体上，论证为何不应过度声称结论。它评估的是 REA 的工具接口，而非重建案例或漏洞发现。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["binary"],"verified_at":"2026-10-18"},{"id":"rea-notes-csv-oracle-mutation-case","name":"Notes CSV export: an author-reported REA check of reconstruction oracles","name_zh":"Notes CSV 导出：作者报告的 REA 重建验收器检查","url":"https://x.com/i/article/2110962506604929025","evidence_url":"https://x.com/i/article/2110962506604929025","description_en":"A Chinese article breaks three versions of a Python CSV exporter that reproduces the Notes teaching app shipped with REA. It shows that a simple export-and-read-back test passes all three, while byte comparisons against the official JavaScript formatter on 215 fixed inputs catch each one. The author also connects REA 6.5.0 over MCP, reruns its JavaScript analysis and checks that an edited evidence record is rejected on import; this is a study of acceptance checks, not a new reconstruction.","description_zh":"一篇中文文章把复刻 REA 自带 Notes 教学应用的 Python CSV 导出器故意改坏三个版本，展示简单的“导出再读回”测试能让三者全部通过，而以官方 JavaScript 格式化函数为参照、在 215 组固定输入上逐字节比较则能逐一识破。作者还通过 MCP 连接 REA 6.5.0，重新运行其 JavaScript 分析，并验证被改动的证据记录在导入时会被拒绝；这是对验收检查的研究，而非新的重建。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-18"},{"id":"windows-loader-static-analysis-case","name":"Windows loader: static malware analysis with REA and Codex","name_zh":"Windows 加载器：借助 REA 与 Codex 的静态恶意软件分析","url":"https://codegeeksai.github.io/en/blog/static-malware-analysis-rea-codex/","evidence_url":"https://codegeeksai.github.io/en/blog/static-malware-analysis-rea-codex/","description_en":"Fedele Mantuano reports using Codex with REA in an offline Docker lab to statically analyze a public Windows malware sample without executing it. The article separates behavior supported by the extracted JavaScript bundle from claims that would depend on remote components that were never obtained, and reclassifies a suspected infostealer as a loader. It is a defensive analysis case built on an author-reviewed agent report, not a reconstruction or a dynamic detonation.","description_zh":"Fedele Mantuano 报告在离线 Docker 实验环境中让 Codex 借助 REA，对一个公开的 Windows 恶意软件样本做静态分析，全程不执行样本。文章区分了提取出的 JavaScript 代码包能够支持的行为与依赖从未获取的远程组件的推断，并将原本疑为信息窃取程序的样本重新归类为加载器。这是以作者审阅过的智能体报告为基础的防御性分析案例，不是重建，也不是动态引爆分析。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["binary"],"verified_at":"2026-10-18"},{"id":"horizon-minecraft-rust-rewrite-case","name":"Horizon: a Rust rewrite of Minecraft: Java Edition 26.3 with REA bytecode queries","name_zh":"Horizon：借助 REA 字节码查询的 Minecraft: Java Edition 26.3 Rust 重写","url":"https://github.com/ludovic111/horizon","evidence_url":"https://github.com/ludovic111/horizon/blob/d500f28ee4939d83d9796931b7079632b72dc948/README.md","description_en":"Rewrites Minecraft: Java Edition 26.3 as a native Rust client, dedicated server and launcher that prepare their resources from the user’s own copy of the game. Contributors are told to read the vanilla code first, and tools/rea_vanilla.py runs a pinned REA release with a headless JADX engine over the shipped client and server jars to inspect classes, methods and callers. Differential harnesses run Java oracles against the real game and Rust probes against Horizon; README reports all 281 passing, which covers only what they compare.","description_zh":"以原生 Rust 客户端、专用服务器和启动器重写 Minecraft: Java Edition 26.3，资源均由使用者自有的游戏副本生成。项目要求贡献者先阅读原版代码，tools/rea_vanilla.py 会调用固定版本的 REA，配合无界面 JADX 引擎分析官方发布的客户端与服务器 jar，查询类、方法及调用方。差分测试工具分别对真实游戏运行 Java 对照程序、对 Horizon 运行 Rust 探针；README 称全部 281 个测试通过，但这只涵盖它们所比较的内容。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game"],"verified_at":"2026-10-19"},{"id":"untangle-rea-evidence-rebuild-case","name":"Untangle: a browser rebuild from REA and Ghidra evidence","name_zh":"Untangle：基于 REA 与 Ghidra 证据的浏览器重建","url":"https://github.com/az9713/untangle-rebuild","evidence_url":"https://github.com/az9713/untangle-rebuild/blob/6e9925105247268befeb6faed69025dfce4778fc/README.md","description_en":"An author-documented REA/Ghidra investigation of the shipped Untangle Windows binary produces a single-page playable rebuild and a claim-by-claim grading receipt. The report separates frozen findings, a later source-code answer key and a prior-knowledge audit.","description_zh":"作者记录了以 REA/Ghidra 调查已发布的 Untangle Windows 二进制，产出单页可玩重建与逐项判定的证据收据，并分开保留冻结发现、后取的源码答案及先验知识审计。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["binary","game"],"verified_at":"2026-11-01T16:36:25Z"},{"id":"sofa-tv-browser-browsehere-case","name":"Sofa TV Browser: a remote-friendly BrowseHere alternative","name_zh":"Sofa TV Browser：面向遥控操作的 BrowseHere 替代应用","url":"https://github.com/sonalder-darlene/sofa-tv-browser","evidence_url":"https://github.com/sonalder-darlene/sofa-tv-browser/blob/6b3afc9544d8e7d2893ed85f184904c8382c02fb/README.md","description_en":"An Android TV browser follows BrowseHere's remote-control interaction design with its own implementation. The author reports using REA to inspect the BrowseHere APK and Claude to build Sofa; the repository documents APK releases, screenshots and current feature limits.","description_zh":"Android TV 浏览器以自己的实现沿用 BrowseHere 的遥控交互设计；作者报告先用 REA 检查 BrowseHere APK，再用 Claude 构建 Sofa，仓库提供 APK 发布、截图及当前功能限制。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-11-01T16:36:25Z"},{"id":"netcat-openbsd-rea-static-case","name":"OpenBSD netcat: static REA and Ghidra investigation","name_zh":"OpenBSD netcat：REA 与 Ghidra 静态调查","url":"https://github.com/NullLabTests/OpenBSD_netcat_REA","evidence_url":"https://github.com/NullLabTests/OpenBSD_netcat_REA/blob/cc1870d34e83bad0b8a6ca2489f6fa177efa6a2a/README.md","description_en":"A REA/Ghidra report studies the Ubuntu netcat-openbsd 1.234-1 ELF binary and publishes evidence envelopes, decompiled functions and a function inventory. Its output is a static investigation, rather than a rebuilt netcat application.","description_zh":"REA/Ghidra 报告研究 Ubuntu netcat-openbsd 1.234-1 ELF 二进制，公开证据封套、反编译函数及函数清单；产物是静态调查，而非重建后的 netcat 应用。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["binary"],"verified_at":"2026-11-01T16:36:25Z"},{"id":"fastview-rea-relay-analysis-rebuild-case","name":"FastView-REA: a Rust reconstruction of Fast View 5","name_zh":"FastView-REA：Fast View 5 的 Rust 重建","url":"https://github.com/dmytrobsp/fastview-rea","evidence_url":"https://github.com/dmytrobsp/fastview-rea/blob/deb89ea4134414a894ba887508ad5d320449be41/README.md","description_en":"A Rust desktop reconstruction of Mekhanotronika Fast View 5 uses REA and Ghidra research to reproduce oscillogram analysis and relay-characteristic views. The project publishes behavioral specifications, factual indexes, screenshots and cross-platform builds, with explicit format and visual-fidelity gaps.","description_zh":"Rust 桌面重建以 REA 与 Ghidra 的研究复现 Mekhanotronika Fast View 5 的录波分析和继电保护特性视图，公开行为规格、事实索引、截图及跨平台构建，并列明格式与视觉保真度缺口。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-11-01T16:43:00Z"},{"id":"openbattlefield2-refractor-engine-case","name":"OpenBattlefield2: an unfinished Refractor 2 engine reimplementation","name_zh":"OpenBattlefield2：尚未完成的 Refractor 2 引擎重实现","url":"https://github.com/Moxnatiy/OpenBattlefield2","evidence_url":"https://github.com/Moxnatiy/OpenBattlefield2/blob/1486ef18f52cb0070c8ae8ae06277a413ecb3977/README.md","description_en":"A C++20 reimplementation of Battlefield 2’s Refractor 2 engine reads original game data and documents menu rendering, level loading and server interoperability. Published crosshair research cites REA/Ghidra evidence IDs and binary addresses; major gameplay systems remain unfinished.","description_zh":"C++20 重实现 Battlefield 2 的 Refractor 2 引擎，读取原始游戏数据，记录菜单渲染、关卡载入及服务器互通；公开的准星研究引用 REA/Ghidra 证据 ID 和二进制地址，主要玩法系统仍未完成。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["binary","game"],"verified_at":"2026-11-01"},{"id":"keen-clone-rea-commander-keen-case","name":"keen-clone: a Commander Keen 1 C/SDL2 port","name_zh":"keen-clone：Commander Keen 1 的 C/SDL2 移植","url":"https://github.com/carlhako/keen-clone","evidence_url":"https://github.com/carlhako/keen-clone/blob/9c6ac72734c95c3260c23b57158ea5876abc14b3/README.md","description_en":"A native Linux and browser port of Commander Keen Episode One is documented as a function-by-function REA/Ghidra reconstruction of KEEN1.EXE. Published analysis artifacts accompany the C/SDL2 game; the scope is the first episode, rather than the entire series.","description_zh":"Linux 原生与浏览器移植面向 Commander Keen 第一章，作者记录以 REA/Ghidra 对 KEEN1.EXE 逐函数研究并重建 C/SDL2 游戏，附带公开分析资料；范围仅为第一章，并非全系列。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["binary","game"],"verified_at":"2026-11-01"},{"id":"samp-client-rea-partial-reconstruction-case","name":"samp-client-re: a partial SA-MP client reconstruction","name_zh":"samp-client-re：局部重建的 SA-MP 客户端","url":"https://github.com/NathanKanaeru/samp-client-re","evidence_url":"https://github.com/NathanKanaeru/samp-client-re/blob/6efde5d3042ee87f0c183a6c68b7e1b26a000cac/README.md","description_en":"A documented REA/Ghidra investigation maps SA-MP 0.3.DL-R1 client subsystems to a new C++ DLL, loader and smoke-test executable. The result is an architectural reconstruction with explicitly unresolved network and graphics behavior, not an established retail-compatible client.","description_zh":"REA/Ghidra 调查将 SA-MP 0.3.DL-R1 客户端子系统映射到新的 C++ DLL、加载器和冒烟测试程序，产物属于架构重建，网络与图形行为仍有明确未知项，未建立零售版兼容性。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["binary","game"],"verified_at":"2026-11-01"},{"id":"desktop-games-nostalgia-rea-port-case","name":"Desktop Games Nostalgia: a macOS and browser port","name_zh":"Desktop Games Nostalgia：macOS 与浏览器移植","url":"https://github.com/ucodia/desktop-games-nostalgia","evidence_url":"https://github.com/ucodia/desktop-games-nostalgia/blob/27946dfe49d4a9b522dfe017c14eefbc0ca40b2a/README.md","description_en":"A Swift/macOS and JavaScript/browser port recreates the Desktop Games screen-smashing toy from a captured image. The author documents Claude and REA/Ghidra work on the Peter interpreter, a decompiled program tree and extracted assets, with explicit visual differences and no project license.","description_zh":"Swift/macOS 与 JavaScript/浏览器移植在截图上重现 Desktop Games 的桌面破坏玩具；作者记录 Claude 与 REA/Ghidra 对 Peter 解释器的研究、反编译程序树及提取素材，并明确列出视觉差异和未提供项目许可。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["binary","game"],"verified_at":"2026-11-01"},{"id":"gunzrs-rea-rust-reimplementation-case","name":"GunZRs: a Rust reimplementation of GunZ: The Duel","name_zh":"GunZRs：GunZ: The Duel 的 Rust 重实现","url":"https://github.com/OpenRsG/GunZRs","evidence_url":"https://github.com/OpenRsG/GunZRs/blob/485575b7451912ed1d62661c388663b08dce4faf/README.md","description_en":"A Rust/Bevy port reads GunZ: The Duel files from the user's installation and provides native releases, browser build tooling, screenshots and a documented REA/Ghidra investigation framework. Its LAN protocol and inferred movement behavior remain distinct from retail-server compatibility and proven gameplay parity.","description_zh":"Rust/Bevy 移植从用户安装中读取 GunZ: The Duel 数据，提供原生发布包、浏览器构建工具、截图及 REA/Ghidra 调查框架；自有局域网协议和推断的移动行为不代表兼容零售服务器或已证明玩法一致。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game"],"verified_at":"2026-11-01"},{"id":"mxqpro-rk3229-rea-repurposing-case","name":"MXQ PRO RK3229: an Android firmware investigation and Linux repurposing","name_zh":"MXQ PRO RK3229：Android 固件调查与 Linux 改造","url":"https://github.com/bigtower17/mxqpro-rk3229","evidence_url":"https://github.com/bigtower17/mxqpro-rk3229/blob/b9079b419373eec439d85df4a8a11be549cd2f56/README.md","description_en":"An owner documents identifying an RK3229 TV box, investigating its stock Android ROM and repurposing it with a userspace gamepad driver and Armbian. REA assisted ADB inventory and Android-provider routing; APK analysis and device changes are reported as a mixed workflow, not firmware reconstruction.","description_zh":"设备所有者记录了 RK3229 电视盒的硬件识别、原厂 Android ROM 调查、用户态手柄驱动及 Armbian 改造；REA 用于 ADB 清点和 Android 分析引擎引导，APK 分析与设备修改属于混合工作流，并非固件重建。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["firmware"],"verified_at":"2026-11-01"},{"id":"icsee-localmod-rea-camera-case","name":"iCSee LocalMod: a stock-firmware camera control extension","name_zh":"iCSee LocalMod：保留原厂固件的摄像头控制扩展","url":"https://github.com/Vittuu/icsee-localmod","evidence_url":"https://github.com/Vittuu/icsee-localmod/blob/52f0ca06064faa2e62ee6d9c600f048bd1768207/README.md","description_en":"An owner-authorized XM530V200 camera case uses REA/Ghidra to investigate native Sofia command handlers, then adds local control and Home Assistant integration while preserving stock drivers and recording. The source-only extension documents separate static, emulated-protocol and physical-device evidence.","description_zh":"XM530V200 摄像头所有者授权案例以 REA/Ghidra 调查原生 Sofia 命令处理器，再添加本地控制及 Home Assistant 集成，保留原厂驱动和录像；源码扩展明确区分静态、模拟协议及实机证据。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["binary","firmware","protocol"],"verified_at":"2026-11-01"},{"id":"app-xray-rea-evidence-reports","name":"App X-Ray","name_zh":"App X-Ray","url":"https://github.com/Eliot5566/app-xray","evidence_url":"https://github.com/Eliot5566/app-xray/blob/66a7b06fb45d99e0e1d1dbcf221856a62639faab/README.md","description_en":"Builds evidence-linked HTML/JSON reports, summary cards and diffs from REA analysis of app packages, native build metadata and model files. Its component and configuration findings come from static inputs; they are not observed runtime traffic, a complete security audit or reconstructed software.","description_zh":"基于 REA 对应用包、原生构建元数据和模型文件的分析生成带证据链接的 HTML/JSON 报告、摘要卡片及差异；组件与配置发现来自静态输入，并非实测流量、完整安全审计或重建软件。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["app","binary"],"verified_at":"2026-11-01"},{"id":"disklens-windirstat-rea-case","name":"DiskLens: a WinDirStat-derived disk usage analyzer","name_zh":"DiskLens：基于 WinDirStat 研究的磁盘用量分析器","url":"https://github.com/KarlssonChristoffer/DiskLens","evidence_url":"https://github.com/KarlssonChristoffer/DiskLens/blob/c7d67f4b084b408d9b3e1bb22ee8723727494488/README.md","description_en":"A Rust/Tauri disk analyzer combines REA/Ghidra investigation of WinDirStat 2.5.0 with source-code ports of its treemap and color handling. Its documentation distinguishes binary-confirmed findings from source-derived algorithms and leaves several file actions and Windows integrations untested.","description_zh":"Rust/Tauri 磁盘分析器结合 REA/Ghidra 对 WinDirStat 2.5.0 的调查及其树图、色彩算法的源码移植；文档区分二进制核对结果与源码来源，并列明多项文件操作和 Windows 集成尚未经实机测试。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app","binary"],"verified_at":"2026-11-01"},{"id":"soundconnect-desktop-rea-engine-case","name":"SoundConnect Desktop: a Windows client reusing a reviewed headset engine","name_zh":"SoundConnect Desktop：复用已调查耳机引擎的 Windows 客户端","url":"https://github.com/B-Howell/soundconnect-desktop","evidence_url":"https://github.com/B-Howell/soundconnect-desktop/blob/481f4af2da2c96026bd14d19f366c76aa737ccd0/README.md","description_en":"A Windows Sony-headphone client adopts existing libmdr/libmdr-bt engine DLLs after a documented REA-assisted binary inventory and source review. The desktop interface is modeled on Sound Connect, while protocol implementation and device support are inherited rather than newly reconstructed.","description_zh":"Windows 索尼耳机客户端在 REA 辅助二进制清点及源码检查后采用既有 libmdr/libmdr-bt 引擎 DLL，桌面界面参考 Sound Connect；协议实现和设备支持来自上游复用，并非本项目重新恢复。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app","binary"],"verified_at":"2026-11-01"},{"id":"rec-rs-obs-rea-recorder-case","name":"rec-rs: an OBS-informed Rust recorder for macOS","name_zh":"rec-rs：参考 OBS 架构的 Rust macOS 录制器","url":"https://github.com/michaelshimeles/rec-rs","evidence_url":"https://github.com/michaelshimeles/rec-rs/blob/93dd4948cdc8919e8b444a5af0141cf7c3628e7c/README.md","description_en":"A macOS recorder is informed by OBS architecture research using REA package inspection, platform tools and public source references. It offers screen/camera recording and streaming with a deliberately smaller scene/source feature set; the research notes record unavailable native-analysis providers.","description_zh":"macOS 录制器参考 OBS 架构，研究结合 REA 软件包检查、平台工具及公开源码资料；提供屏幕/摄像头录制和推流，但场景、输入源功能范围更小，研究笔记明确记录原生分析引擎不可用。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-11-01"},{"id":"sketch-paper-rea-canvas-case","name":"Sketch: a Paper-shell-informed native Rust canvas","name_zh":"Sketch：基于 Paper 壳层研究的原生 Rust 画布","url":"https://github.com/michaelshimeles/sketch","evidence_url":"https://github.com/michaelshimeles/sketch/blob/af814b7ab2bd77328a906a1986a048c233e25f9c/README.md","description_en":"A Rust canvas models Paper-like editing behavior after REA investigation of the Paper Desktop shell. The hosted editor was not recovered: research separates observed shell integration from inferred editor features, and the new geometric document model differs from Paper HTML/CSS.","description_zh":"Rust 画布在 REA 调查 Paper Desktop 壳层后参考其编辑行为；没有恢复托管编辑器，研究区分已观察的壳层集成与推断的编辑器功能，新几何文档模型也不同于 Paper 的 HTML/CSS。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-11-01"},{"id":"terminal-tradingview-rea-chart-case","name":"Terminal: a Rust terminal informed by TradingView chart research","name_zh":"Terminal：参考 TradingView 图表研究的 Rust 终端","url":"https://github.com/michaelshimeles/terminal","evidence_url":"https://github.com/michaelshimeles/terminal/blob/94bb329d683471518dcd210f9ca9fca073c15d0b/README.md","description_en":"An independent Rust market interface uses REA browser-scenario research on public logged-out TradingView chart interactions. The notes retain observed/documented/inferred/unknown labels; the result supplies its own chart engine and data providers rather than recovering TradingView or Bloomberg server software.","description_zh":"独立 Rust 市场界面参考 REA 对公开、未登录 TradingView 图表交互的场景研究；笔记保留观察、文档、推断及未知标签，产物使用自己的图表引擎和数据源，而非恢复 TradingView 或 Bloomberg 服务端软件。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app","website"],"verified_at":"2026-11-01"},{"id":"awesome-malware-analysis","name":"Awesome Malware Analysis","name_zh":"Awesome Malware Analysis 恶意软件分析合集","url":"https://github.com/rshipp/awesome-malware-analysis","evidence_url":"https://github.com/rshipp/awesome-malware-analysis/blob/179887b9bfb04bb736348b2dc9d331bc860c6ef7/README.md","description_en":"A long-running single-README list of malware analysis tools and resources, grouped into 17 top-level sections covering open-source threat intelligence, detection and classification, online scanners and sandboxes, document and shellcode analysis, deobfuscation, debugging and reverse engineering, network, memory forensics, Windows artifacts, plus books and other references. Each entry is a name linked to an external tool or resource with a short description. The repository also keeps a Simplified Chinese translation of the list.","description_zh":"长期维护的单 README 恶意软件分析工具与资源清单，分为 17 个一级章节，涵盖开源威胁情报、检测与分类、在线扫描器与沙箱、文档与 shellcode 分析、反混淆、调试与逆向、网络、内存取证、Windows 取证痕迹，以及书籍和其他参考资料。每个条目是链接到外部工具或资源的名称并附简短说明。仓库中另附有该清单的简体中文翻译。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-20"},{"id":"awesome-connected-things-sec","name":"Awesome Connected Things Security","name_zh":"Awesome Connected Things Security 互联设备安全合集","url":"https://github.com/V33RU/awesome-connected-things-sec","evidence_url":"https://github.com/V33RU/awesome-connected-things-sec/blob/0015dcee55cc0cd6eff3b4afbada2f22c245a9cc/README.md","description_en":"A single-README list of security-research references for IoT, embedded, industrial and automotive systems, organized into sections on hardware attacks, wireless protocols (BLE, Zigbee/Z-Wave, LoRa, Matter/Thread, cellular, NFC/RFID, Wi-Fi, USB), firmware security including extraction, static and dynamic analysis and secure boot, network and web protocols, cloud backends, mobile apps, and industrial and automotive topics. Each entry links out to an external tool, talk, paper, write-up or course with a short note. The README reports 900+ resources.","description_zh":"面向 IoT、嵌入式、工业和汽车系统的单 README 安全研究资料清单，按章节组织，涵盖硬件攻击、无线协议（BLE、Zigbee/Z-Wave、LoRa、Matter/Thread、蜂窝、NFC/RFID、Wi-Fi、USB）、固件安全（含提取、静态与动态分析和安全启动）、网络与 Web 协议、云后端、移动应用，以及工业和汽车相关主题。每个条目链接到外部的工具、演讲、论文、文章或课程并附简短说明。README 称收录 900 多项资源。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["firmware","protocol"],"verified_at":"2026-10-20"},{"id":"awesome-canbus","name":"Awesome CAN Bus","name_zh":"Awesome CAN Bus CAN 总线合集","url":"https://github.com/iDoka/awesome-canbus","evidence_url":"https://github.com/iDoka/awesome-canbus/blob/77c59133db2fcdd4e4f891a55e440629e0178b8e/README.md","description_en":"A single-README list of CAN bus tools, hardware and resources for automotive and embedded work, grouped into sections for reverse-engineering tools, test equipment and simulators, higher-layer protocols (OBD-II, UDS, ISO-TP, J1939, J2534), general and Linux utilities, CAN database formats (DBC, KCD) with converters, and hardware for ARM, Arduino, ESP32, single-board computers and FPGA cores. Each entry links out to an external project or resource with a short description.","description_zh":"面向汽车和嵌入式领域的单 README CAN 总线工具、硬件与资源清单，分为逆向工程工具、测试设备与模拟器、上层协议（OBD-II、UDS、ISO-TP、J1939、J2534）、通用与 Linux 实用工具、CAN 数据库格式（DBC、KCD）及转换器，以及面向 ARM、Arduino、ESP32、单板计算机和 FPGA 核心的硬件等章节。每个条目链接到外部项目或资源并附简短说明。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["firmware","protocol"],"verified_at":"2026-10-20"},{"id":"awesome-automotive-can-id","name":"Awesome CAN ID","name_zh":"Awesome CAN ID 汽车 CAN 报文标识符合集","url":"https://github.com/iDoka/awesome-automotive-can-id","evidence_url":"https://github.com/iDoka/awesome-automotive-can-id/blob/8eff640cd49984df4b37d996da46deaf81e53b52/README.md","description_en":"A single-README list that gathers links to CAN message identifier and payload decodings in one place, grouped by vehicle make and model under about 30 car brands and brand groups plus BMW, Ducati and KTM motorcycles. Its links lead to DBC files, decoding spreadsheets, wiki pages, sniffing notes and small libraries maintained elsewhere, after a Common section of general databases such as comma.ai’s opendbc and the OpenGarages CAN ID references.","description_zh":"以单个 README 维护的清单，把 CAN 报文标识符与载荷解码资料的链接汇集在一处，按车辆品牌和车型分组，涵盖约 30 个汽车品牌及品牌集团，另有 BMW、Ducati 和 KTM 摩托车。条目链接到其他地方维护的 DBC 文件、解码表格、wiki 页面、抓包笔记和小型库；开头的 Common 部分收录 comma.ai 的 opendbc 和 OpenGarages CAN ID 参考等通用数据库。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["protocol"],"verified_at":"2026-10-20"},{"id":"rea-bigger-model-essay-case","name":"Does reverse engineering need a bigger model? General and specialist models in Touhou reconstruction","name_zh":"逆向工程需要更大的模型吗？东方 Project 重建中的通用模型与专用模型","url":"https://rea.tools/blog/reverse-engineering-models/","evidence_url":"https://github.com/morluto/rea/blob/e8da7e1edd075feec0e6beedec93d5645fed8125/website/evidence/reverse-engineering-models.md","description_en":"An essay on REA’s site by N0zoM1z0 (13 October 2026) uses dated Touhou reconstruction commits to ask whether exact function matching needs a larger general model, a compiler-specialist model or better retrieval. It walks through TH09, TH095, TH04 and TH08 cases where later GPT-6-series sessions closed stubborn matches, and the TH08 audit that found accepted functions with wrong floating constants. Specialist and reinforcement-learning comparisons are proposed as future experiments; no trained specialist was evaluated.","description_zh":"REA 网站上 N0zoM1z0 的一篇文章（2026 年 10 月 13 日）依据注明日期的东方 Project 重建提交，探讨精确的函数匹配究竟需要更大的通用模型、针对编译器的专用模型，还是更好的检索。文章逐一介绍 TH09、TH095、TH04 与 TH08 中较晚的 GPT-6 系列会话攻克难以匹配函数的案例，以及 TH08 一次审计发现部分已接受函数含有错误浮点常量的经过。专用模型与强化学习的对比被作为未来实验提出，并未评估任何经过训练的专用模型。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"aishihzong-awesome-reverse-engineer-anything","name":"Awesome REA: Reverse Engineer Anything with AI (AIshihzong)","name_zh":"Awesome REA：用 AI 逆向一切（AIshihzong）","url":"https://github.com/AIshihzong/awesome-reverse-engineer-anything","evidence_url":"https://github.com/AIshihzong/awesome-reverse-engineer-anything/blob/55f9ff058c44a55b63cef83aaf6ea42dcbd6e5b2/README.md","description_en":"An unofficial, bilingual awesome list of what AI agents have reverse-engineered and rebuilt, tagged by whether each case's own sources show that REA was used. It gathers REA's official resources and showcases; community cases in games, apps, hardware and protocols, and security evaluations; the wider wave of AI reverse engineering and clean-room rebuilds without confirmed REA; plugins, guides and research, related MCP tools, other lists and press; and a section on legal questions and controversy.","description_zh":"一份非官方的中英双语 awesome 清单，收录 AI 智能体逆向分析并重建过的项目，并按各案例自身来源能否证明使用了 REA 加注标签。内容包括 REA 的官方资源与展示案例；游戏、应用、硬件与协议以及安全评估方面的社区案例；未确认使用 REA 的更广泛 AI 逆向与净室重写项目；插件、指南与研究、相关 MCP 工具、其他清单和媒体报道；另有一节讨论法律问题与争议。","kind":"collection","category":"related-lists","group":"learn","relationship":"community-learning-resource","targets":["app","binary","game","protocol"],"verified_at":"2026-10-27"},{"id":"ai-rebuilds-directory","name":"AI Rebuilds","name_zh":"AI Rebuilds：无源码重建软件与游戏的项目目录","url":"https://ai-rebuilds.com/","evidence_url":"https://github.com/a-barzanti/ai-rebuilds/blob/8092b23421fca9c8c4c52d51e34d4dc602f95923/README.md","description_en":"A website and GitHub list of 81 projects that rebuild existing software or games without the original source: AI-built clean-room apps such as the ArtCraft suite, software rewritten with coding agents, AI-assisted game decompilations, game engine reimplementations, human-led decompilations and ports, clean-room classics such as Wine and ReactOS, and tools for rebuilders. Each entry says what it rebuilds and carries a method label and an AI-involvement label, and the site can be searched, filtered and sorted by stars or recent activity. A separate guide describes a clean-room rebuild workflow with REA.","description_zh":"网站及 GitHub 列表，收录 81 个在没有原始源码的情况下重建现有软件或游戏的项目：由 AI 构建的净室应用（如 ArtCraft 套件）、借助编码智能体重写的软件、AI 辅助的游戏反编译、游戏引擎重新实现、由人主导的反编译与移植、Wine 和 ReactOS 等经典净室实现，以及重建工具。每个条目说明重建对象，并带有方法标签和 AI 参与程度标签；网站支持搜索、筛选，并可按星标数或近期活跃度排序。另有一篇指南介绍借助 REA 进行净室重建的流程。","kind":"collection","category":"related-lists","group":"learn","relationship":"community-learning-resource","targets":["app","binary","game"],"verified_at":"2026-11-02"},{"id":"reaguide-unofficial-rea-guide","name":"REA & AI RE Tools Guide (unofficial)","name_zh":"REA & AI RE Tools Guide（非官方）：REA 安装、接入与故障排查社区指南","url":"https://reaguide.com/","evidence_url":"https://reaguide.com/","description_en":"An unofficial, independently run guide to installing REA and connecting it to coding agents, in 32 pages: install paths for npx, npm and Bun including Windows, MCP setup for Claude Code and Desktop, Codex, Cursor, Windsurf and Gemini CLI, a config generator for 24 clients, Ghidra, IDA and JADX provider setup, and troubleshooting pages that match exact error text to upstream REA issues. Several pages record the author's own runs, such as Android APK analysis through headless JADX on rea-agents 6.5.0 and a Claude Code setup re-test on 6.8.0. The site also compares REA with Ghidra, IDA and other reverse-engineering MCP servers and documents look-alike REA copies.","description_zh":"由个人独立运营的非官方 REA 指南，共 32 个页面，介绍如何安装 REA 并接入编码智能体：涵盖 npx、npm 与 Bun 安装路径（含 Windows），Claude Code 与 Claude Desktop、Codex、Cursor、Windsurf 和 Gemini CLI 的 MCP 配置，支持 24 种客户端的配置生成器，Ghidra、IDA 与 JADX 分析引擎设置，以及把确切报错文本对应到 REA 上游 issue 的故障排查页面。部分页面记录了作者自己的运行结果，例如在 rea-agents 6.5.0 上通过无界面 JADX 分析 Android APK，以及在 6.8.0 上重新测试 Claude Code 配置。网站还将 REA 与 Ghidra、IDA 及其他逆向 MCP 服务器作比较，并记录冒充 REA 的仿冒副本。","kind":"learning-resource","category":"community-labs","group":"learn","relationship":"community-learning-resource","targets":["app","binary","website"],"verified_at":"2026-11-02"},{"id":"sh23ds-case","name":"sh23ds: a native 3DS reconstruction of Silent Hill 2","name_zh":"sh23ds：《寂静岭 2》的 3DS 原生重建","url":"https://github.com/ankushKun/sh23ds","evidence_url":"https://github.com/ankushKun/sh23ds/blob/08673f69aa99b4f3c00a181b31c7adc26c186408/README.md","description_en":"sh23ds rebuilds Silent Hill 2: Director's Cut as a native C engine for Nintendo 3DS using the player's PC game data. Game logic, camera, lighting and events were reconstructed from the PC executable; the research notes report analysis with Ghidra and REA. The author reports a complete playthrough in Azahar, while real-console testing and some PC behaviors remain unfinished.","description_zh":"sh23ds 以 C 为 Nintendo 3DS 重建《寂静岭 2：导演剪辑版》的原生引擎，游戏数据由玩家自己的 PC 版本转换。项目从 PC 可执行文件还原逻辑、镜头、光照和事件；研究笔记记载使用 Ghidra 与 REA。作者报告在 Azahar 中可通关，但实体主机测试和部分 PC 行为仍待完善。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game"],"verified_at":"2026-11-06"},{"id":"hex-rays-ida-mcp","name":"Hex-Rays IDA MCP","name_zh":"Hex-Rays IDA MCP","url":"https://github.com/HexRaysSA/ida-mcp","evidence_url":"https://github.com/HexRaysSA/ida-mcp/blob/a03842843d6972eb8780f5b3d2f4e8b6d0c9589e/README.md","description_en":"Official Hex-Rays MCP server for agent access to IDA databases, with headless operation and optional GUI integration.","description_zh":"Hex-Rays 官方 MCP 服务，让智能体操作 IDA 数据库，支持无界面分析和可选 GUI 联动。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-15"},{"id":"ghidramcp","name":"GhidraMCP","name_zh":"GhidraMCP","url":"https://github.com/LaurieWired/GhidraMCP","evidence_url":"https://github.com/LaurieWired/GhidraMCP/blob/1e980252087b2479a21b9ca6d82d5829538651a7/README.md","description_en":"Ghidra extension and MCP bridge exposing decompilation, symbol navigation and renaming to agents, with GUI and headless modes.","description_zh":"通过 Ghidra 扩展和 MCP 桥接提供反编译、符号导航与重命名，支持 GUI 和无界面运行。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-17"},{"id":"binary-ninja-official-mcp","name":"Binary Ninja MCP (official)","name_zh":"Binary Ninja MCP（官方）","url":"https://docs.binary.ninja/guide/mcp.html","evidence_url":"https://docs.binary.ninja/guide/mcp.html","description_en":"Binary Ninja's own MCP interface exposes functions, symbols, disassembly, intermediate languages and decompiled text to agents.","description_zh":"Binary Ninja 自带的 MCP 接口向智能体提供函数、符号、反汇编、中间语言和反编译文本。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-17"},{"id":"binary-ninja-community-mcp","name":"Binary Ninja MCP (fosdickio)","name_zh":"Binary Ninja MCP（fosdickio）","url":"https://github.com/fosdickio/binary_ninja_mcp","evidence_url":"https://github.com/fosdickio/binary_ninja_mcp/blob/eaf8a980050bee123f1be30334e74b15d21c009c/README.md","description_en":"Community Binary Ninja plugin and bridge for MCP clients, including workflows that switch among multiple open binaries.","description_zh":"社区维护的 Binary Ninja 插件与 MCP 桥接，支持在多个已打开的二进制目标间切换。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-15"},{"id":"ida-pro-mcp-community","name":"IDA Pro MCP (mrexodia)","name_zh":"IDA Pro MCP（mrexodia）","url":"https://github.com/mrexodia/ida-pro-mcp","evidence_url":"https://github.com/mrexodia/ida-pro-mcp/blob/c133c3853faa111a9b00ee615c013b720d0c4acd/README.md","description_en":"Community IDA integration useful for existing setups and migration context; its maintainer now recommends the official Hex-Rays MCP server.","description_zh":"已有工作流可参考的社区 IDA 集成；维护者目前推荐迁移到 Hex-Rays 官方 MCP 服务。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-17"},{"id":"radare2-mcp","name":"Radare2 MCP Server","name_zh":"Radare2 MCP Server","url":"https://github.com/radareorg/radare2-mcp","evidence_url":"https://github.com/radareorg/radare2-mcp/blob/562c0cf23c42b65b3052f0b294d8778c20facbde/README.md","description_en":"Native radare2 MCP server offering binary-analysis tools, reusable sessions and configurable read-only access.","description_zh":"基于 radare2 原生接口的 MCP 服务，提供二进制分析、会话复用和可配置的只读访问。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-17"},{"id":"r2ai","name":"r2ai","name_zh":"r2ai","url":"https://github.com/radareorg/r2ai","evidence_url":"https://github.com/radareorg/r2ai/blob/312921c2a1a39cc6934160f416baecf1330d679e/README.md","description_en":"AI plugins inside radare2 for function explanations, naming suggestions and model-assisted decompilation using local or remote models.","description_zh":"在 radare2 内使用本地或远程模型，辅助解释函数、改善命名和反编译结果。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-15"},{"id":"daila","name":"DAILA","name_zh":"DAILA","url":"https://github.com/mahaloz/DAILA","evidence_url":"https://github.com/mahaloz/DAILA/blob/af4d6491a327af85f9e0aae0ffa7b7a5acbbbfb8/README.md","description_en":"Decompiler-independent AI assistant for function summaries and naming across IDA, Ghidra, Binary Ninja and angr-management.","description_zh":"跨 IDA、Ghidra、Binary Ninja 与 angr-management 的 AI 助手，用于函数摘要和命名辅助。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-15"},{"id":"revengai-ghidra","name":"RevEng.AI Ghidra Plugin","name_zh":"RevEng.AI Ghidra 插件","url":"https://github.com/RevEngAI/plugin-ghidra","evidence_url":"https://github.com/RevEngAI/plugin-ghidra/blob/7d386f772530905222c8aa9276de06995b289930/README.md","description_en":"Connects Ghidra to RevEng.AI for function similarity, recovered names, AI explanations and agent-assisted annotation.","description_zh":"将 Ghidra 接入 RevEng.AI，用于函数相似性匹配、名称恢复、AI 解释及辅助标注。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-17"},{"id":"jadx-ai-mcp","name":"JADX-AI-MCP","name_zh":"JADX-AI-MCP","url":"https://github.com/zinja-coder/jadx-ai-mcp","evidence_url":"https://github.com/zinja-coder/jadx-ai-mcp/blob/ce64f2261b1d17083210ec87bf52f738c50dc48d/README.md","description_en":"JADX plugin paired with a Python MCP server to inspect decompiled Android classes, resources, cross-references and debugger context.","description_zh":"结合 JADX 插件与 Python MCP 服务，读取 Android 反编译代码、资源、交叉引用和调试上下文。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app"],"verified_at":"2026-10-15"},{"id":"apktool-mcp-server","name":"apktool-mcp-server","name_zh":"apktool-mcp-server Apktool MCP 服务","url":"https://github.com/zinja-coder/apktool-mcp-server","evidence_url":"https://github.com/zinja-coder/apktool-mcp-server/blob/12bb33134af905923a0a58643dcc35fd694ad6f6/README.md","description_en":"Python MCP server that drives a local Apktool install so agents can decode APKs; list, read, search and edit smali and resource files; read AndroidManifest.xml and apktool.yml; and rebuild the project.","description_zh":"基于 Python 的 MCP 服务，调用本地安装的 Apktool，使智能体能够解码 APK，列出、读取、搜索和修改 smali 与资源文件，读取 AndroidManifest.xml 与 apktool.yml，并重新构建项目。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app"],"verified_at":"2026-10-17"},{"id":"frida-mcp-yfe404","name":"frida-mcp (yfe404)","name_zh":"frida-mcp (yfe404)","url":"https://github.com/yfe404/frida-mcp","evidence_url":"https://github.com/yfe404/frida-mcp/blob/fb7d6c7c74bd249dbc86b8a3c14df79d9486b114/README.md","description_en":"Frida MCP server with persistent instrumentation sessions, runtime inspection and Android static-to-dynamic navigation.","description_zh":"Frida MCP 服务，提供持久插桩会话、运行时检查和 Android 静态代码与动态现场之间的导航。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app","game"],"verified_at":"2026-10-17"},{"id":"super-trouper","name":"Super Trouper","name_zh":"Super Trouper","url":"https://github.com/crissyfield/super-trouper","evidence_url":"https://github.com/crissyfield/super-trouper/blob/b3d31adbdb4be2f1a456dc9108ef25655ea206fe/README.md","description_en":"Single-binary Frida MCP server for discovering devices, managing process sessions and loading instrumentation scripts.","description_zh":"单个可执行文件形式的 Frida MCP 服务，用于发现设备、管理进程会话和加载插桩脚本。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app","game"],"verified_at":"2026-10-17"},{"id":"lldb-mcp","name":"LLDB MCP","name_zh":"LLDB MCP","url":"https://lldb.llvm.org/use/mcp.html","evidence_url":"https://lldb.llvm.org/use/mcp.html","description_en":"LLDB's official MCP interface gives agents debugger sessions and commands for breakpoints, memory inspection and stepping.","description_zh":"LLDB 官方 MCP 接口提供调试会话与命令，使智能体可以设置断点、检查内存和单步执行。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app","binary"],"verified_at":"2026-10-17"},{"id":"claude-reverse-engineering-skill","name":"Claude Reverse Engineering Skill","name_zh":"Claude 逆向工程技能","url":"https://github.com/EncidXVII/claude-reverse-engineering-skill","evidence_url":"https://github.com/EncidXVII/claude-reverse-engineering-skill/blob/bf4605e92b06511d9d0e2e958ecd00e1f6856c3a/README.md","description_en":"Community agent skill for triage, headless exports and evidence-based RE reports; explicitly documents workflows with REA and other MCP servers.","description_zh":"社区智能体技能，覆盖分诊、无界面导出和证据报告，并明确说明 REA 及其他 MCP 服务的工作流。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["app","binary"],"verified_at":"2026-10-15"},{"id":"specterops-re-skills","name":"SpecterOps Reverse Engineering Skills","name_zh":"SpecterOps 逆向工程技能","url":"https://github.com/SpecterOps/skills/tree/main/plugins/reverse-engineering","evidence_url":"https://github.com/SpecterOps/skills/blob/a78853eaeaed9fb40aba52a0e52ab43785515318/plugins/reverse-engineering/README.md","description_en":"Focused Binary Ninja and Ghidra analysis skills that describe MCP tool use, analysis recipes and annotation practices.","description_zh":"针对 Binary Ninja 与 Ghidra 的分析技能，提供 MCP 工具使用、分析步骤和标注方法。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-15"},{"id":"ghidra","name":"Ghidra","name_zh":"Ghidra","url":"https://github.com/NationalSecurityAgency/ghidra","evidence_url":"https://github.com/NationalSecurityAgency/ghidra/blob/864999d7ca67cd3f533be600860f102e54370661/README.md","description_en":"Open-source analysis suite for disassembly, decompilation, graphs and Java/Python automation across executable formats.","description_zh":"开源二进制分析套件，提供反汇编、反编译、图形分析及 Java/Python 自动化接口。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware","game"],"verified_at":"2026-10-15"},{"id":"radare2","name":"radare2","name_zh":"radare2","url":"https://github.com/radareorg/radare2","evidence_url":"https://github.com/radareorg/radare2/blob/6ac96f50eafef46c1ac75a478a1460819968c66f/README.md","description_en":"Scriptable command-line framework for inspecting, disassembling, debugging and modifying binaries across many architectures.","description_zh":"可脚本化的命令行逆向框架，支持多架构二进制检查、反汇编、调试和修改。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"cutter","name":"Cutter","name_zh":"Cutter","url":"https://github.com/rizinorg/cutter","evidence_url":"https://github.com/rizinorg/cutter/blob/734acd17061a4527d9a89668537e3bc64a475e54/README.md","description_en":"Rizin-powered graphical reverse-engineering workspace with extensible views and Ghidra decompiler integration.","description_zh":"基于 Rizin 的图形逆向工作台，提供可扩展视图及 Ghidra 反编译器集成。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"frida","name":"Frida","name_zh":"Frida","url":"https://github.com/frida/frida","evidence_url":"https://github.com/frida/frida/blob/e598d053f4154fa78a26bb60d4f6cbc407ea387c/README.md","description_en":"Dynamic instrumentation toolkit for observing and scripting the behavior of live native and managed processes.","description_zh":"动态插桩工具，用脚本观察和分析运行中的原生及托管进程行为。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","game"],"verified_at":"2026-10-15"},{"id":"jadx","name":"JADX","name_zh":"JADX","url":"https://github.com/skylot/jadx","evidence_url":"https://github.com/skylot/jadx/blob/c4c45fde27b4f3386dc2ff016ff187229a60a716/README.md","description_en":"Dex-to-Java decompiler with CLI/GUI navigation, resource decoding and cross-reference search for Android packages.","description_zh":"将 Dex 反编译为 Java 的 CLI/GUI 工具，提供 Android 资源解码、代码导航和引用搜索。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-17"},{"id":"apktool","name":"Apktool","name_zh":"Apktool","url":"https://github.com/iBotPeaches/Apktool","evidence_url":"https://github.com/iBotPeaches/Apktool/blob/0312d212c713c9ebc568b7d9295eec0f47858bfa/README.md","description_en":"Decodes Android resources and smali into a project-like tree and can rebuild modified packages.","description_zh":"将 Android 资源与 smali 解码为项目目录，并支持重新构建修改后的安装包。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-15"},{"id":"androguard","name":"Androguard","name_zh":"Androguard","url":"https://github.com/androguard/androguard","evidence_url":"https://github.com/androguard/androguard/blob/90e7b42940a8f73228368e761bb20227d3d9249a/README.md","description_en":"Python toolkit for APK/DEX metadata, bytecode and reference analysis; the v5 source branch also documents agent skills and MCP.","description_zh":"用于 APK/DEX 元数据、字节码及引用分析的 Python 工具集；v5 源码分支还提供智能体技能和 MCP 文档。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-15"},{"id":"ilspy","name":"ILSpy","name_zh":"ILSpy","url":"https://github.com/icsharpcode/ILSpy","evidence_url":"https://github.com/icsharpcode/ILSpy/blob/729b5dc4d12b8bc08c2a0b1294bbb161098a6211/README.md","description_en":".NET assembly browser and C# decompiler with whole-project export, metadata inspection and a scriptable command-line frontend.","description_zh":".NET 程序集浏览器与 C# 反编译器，支持完整项目导出、元数据检查和命令行处理。","kind":"tool","category":"dotnet","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-15"},{"id":"dnspyex","name":"dnSpyEx","name_zh":"dnSpyEx","url":"https://github.com/dnSpyEx/dnSpy","evidence_url":"https://github.com/dnSpyEx/dnSpy/blob/de5a83051161e0becc70f32834c2596db6239fbd/README.md","description_en":"Community continuation of dnSpy for debugging and editing .NET assemblies without the original source.","description_zh":"dnSpy 的社区延续项目，可在没有原始源码时调试和编辑 .NET 程序集。","kind":"tool","category":"dotnet","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-15"},{"id":"electron-asar","name":"@electron/asar","name_zh":"@electron/asar","url":"https://github.com/electron/asar","evidence_url":"https://github.com/electron/asar/blob/01bc908255640c544ac68ea2fe14926a7b80da37/README.md","description_en":"Electron's archive tool lists and extracts ASAR contents so packaged JavaScript and application assets can be inspected.","description_zh":"Electron 官方归档工具，可列出和提取 ASAR 内容，便于检查打包后的 JavaScript 与应用资源。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app","website"],"verified_at":"2026-10-15"},{"id":"webcrack","name":"webcrack","name_zh":"webcrack","url":"https://github.com/j4k0xb/webcrack","evidence_url":"https://github.com/j4k0xb/webcrack/blob/0d83a6f2b04e86fa2e87ee4cb6853848cc719308/README.md","description_en":"Improves JavaScript readability by reversing supported obfuscation patterns and unpacking webpack/Browserify bundles.","description_zh":"识别支持的 JavaScript 混淆模式，并拆解 webpack/Browserify 打包文件，改善代码可读性。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app","website"],"verified_at":"2026-10-15"},{"id":"humanify","name":"humanify","name_zh":"humanify JavaScript 标识符重命名工具","url":"https://github.com/jehna/humanify","evidence_url":"https://github.com/jehna/humanify/blob/65b90bc4743b23317f13d01894776643dbde7fdb/README.md","description_en":"Rename identifiers in minified JavaScript with LLM-suggested names, applied through scope-aware AST rewriting so the program structure stays unchanged. The new names are model suggestions, not recovered original identifiers.","description_zh":"借助 LLM 为压缩后的 JavaScript 标识符建议名称，并通过遵循作用域的 AST 改写完成重命名，程序结构保持不变。新名称是模型给出的推测，并非恢复出的原始标识符。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-17"},{"id":"wabt","name":"WABT","name_zh":"WABT","url":"https://github.com/WebAssembly/wabt","evidence_url":"https://github.com/WebAssembly/wabt/blob/806787e92904571c4628065277344f42c55ece05/README.md","description_en":"WebAssembly tools for binary-to-text conversion, section inspection, validation, interpretation and C translation.","description_zh":"WebAssembly 二进制与文本转换、节区检查、验证、解释执行及 C 转换工具集。","kind":"tool","category":"webassembly","group":"tools","relationship":"foundation","targets":["binary","website"],"verified_at":"2026-10-15"},{"id":"wasm-tools","name":"wasm-tools","name_zh":"wasm-tools","url":"https://github.com/bytecodealliance/wasm-tools","evidence_url":"https://github.com/bytecodealliance/wasm-tools/blob/a56e8d3d2a0b754e0465c668f8e4b68bad97590f/README.md","description_en":"Bytecode Alliance CLI and Rust libraries for inspecting WebAssembly modules, metadata, components and WIT interfaces.","description_zh":"Bytecode Alliance 提供的 CLI 与 Rust 库，用于检查 WebAssembly 模块、元数据、组件和 WIT 接口。","kind":"tool","category":"webassembly","group":"tools","relationship":"foundation","targets":["binary","website"],"verified_at":"2026-10-15"},{"id":"binwalk","name":"Binwalk","name_zh":"Binwalk","url":"https://github.com/ReFirmLabs/binwalk","evidence_url":"https://github.com/ReFirmLabs/binwalk/blob/e0a4434159f22ff926c1baa3872d93a5f8dbf87e/README.md","description_en":"Identifies embedded formats and optionally extracts their contents, with entropy analysis for firmware triage.","description_zh":"识别固件中的嵌入格式并按需提取内容，辅以熵分析帮助初步分诊。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-15"},{"id":"unblob","name":"unblob","name_zh":"unblob","url":"https://github.com/onekey-sec/unblob","evidence_url":"https://github.com/onekey-sec/unblob/blob/3b470cd1c33e10a3ae977a6caaab5dbcbf2d5ce8/README.md","description_en":"Recursively extracts archives and filesystems from binary blobs while reporting chunk boundaries and unknown regions.","description_zh":"递归提取二进制数据中的归档与文件系统，同时报告数据块边界和未识别区域。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-15"},{"id":"ghidra-firmware-utils","name":"Ghidra Firmware Utilities","name_zh":"Ghidra 固件工具集","url":"https://github.com/al3xtjames/ghidra-firmware-utils","evidence_url":"https://github.com/al3xtjames/ghidra-firmware-utils/blob/f54438b90a0effc0a89ef7c0ea3053e5086f422f/README.md","description_en":"Ghidra loaders and helpers for PCI option ROMs, UEFI firmware volumes, Intel flash descriptors and coreboot images.","description_zh":"面向 PCI Option ROM、UEFI 固件卷、Intel Flash Descriptor 和 coreboot 镜像的 Ghidra 加载器与辅助脚本。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-15"},{"id":"qiling","name":"Qiling","name_zh":"Qiling","url":"https://github.com/qilingframework/qiling","evidence_url":"https://github.com/qilingframework/qiling/blob/206b90fd891cee4bc0056d2198ddf85678b55f96/README.md","description_en":"Python emulation framework that adds OS, filesystem and API behavior around CPU emulation for instrumented binary analysis.","description_zh":"在 CPU 仿真之上补充操作系统、文件系统和 API 行为的 Python 框架，用于可插桩的二进制分析。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-15"},{"id":"unicorn","name":"Unicorn Engine","name_zh":"Unicorn Engine","url":"https://github.com/unicorn-engine/unicorn","evidence_url":"https://github.com/unicorn-engine/unicorn/blob/c24c9ebe773ce6fbecb0e39f68ffb23b7326b17f/README.md","description_en":"Multi-architecture CPU emulator for executing selected instruction ranges with register, memory and hook control.","description_zh":"多架构 CPU 仿真引擎，可控制寄存器、内存和钩子，执行选定的指令片段。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary","firmware","game"],"verified_at":"2026-10-15"},{"id":"angr","name":"angr","name_zh":"angr","url":"https://github.com/angr/angr","evidence_url":"https://github.com/angr/angr/blob/ae9f5786fd94410ca400063bf21719aa8b564d3e/README.md","description_en":"Python binary-analysis framework combining control-flow recovery, symbolic execution, data-flow analysis and decompilation.","description_zh":"结合控制流恢复、符号执行、数据流分析和反编译的 Python 二进制分析框架。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-17"},{"id":"lief","name":"LIEF","name_zh":"LIEF","url":"https://github.com/lief-project/LIEF","evidence_url":"https://github.com/lief-project/LIEF/blob/b68429c52d5f704e34445e92890fd801937f10e3/README.md","description_en":"Library for structured parsing and modification of executable formats including ELF, PE and Mach-O.","description_zh":"对 ELF、PE、Mach-O 等可执行文件格式进行结构化解析与修改的库。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-15"},{"id":"capstone","name":"Capstone","name_zh":"Capstone","url":"https://github.com/capstone-engine/capstone","evidence_url":"https://github.com/capstone-engine/capstone/blob/d7ef910bc6e76561e705511db4db964ffde015e2/README.md","description_en":"Disassembly library with architecture-neutral APIs and instruction details for custom binary-analysis pipelines.","description_zh":"提供统一 API 和指令细节的多架构反汇编库，适合构建自定义二进制分析流程。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-15"},{"id":"imhex","name":"ImHex","name_zh":"ImHex","url":"https://github.com/WerWolv/ImHex","evidence_url":"https://github.com/WerWolv/ImHex/blob/fddad83966128b96dc1a8c9d55ba0ccd0721e276/README.md","description_en":"Hex editor with a binary-pattern language, structured data inspection and visual tools for understanding file formats.","description_zh":"带二进制模式语言、结构化数据检查及可视化功能的十六进制编辑器，适合理解文件格式。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware","game"],"verified_at":"2026-10-15"},{"id":"x64dbg","name":"x64dbg","name_zh":"x64dbg","url":"https://github.com/x64dbg/x64dbg","evidence_url":"https://github.com/x64dbg/x64dbg/blob/ac4db12e133a3b2a91756fd2fbe864aa8dd1c453/README.md","description_en":"Windows binary debugger with disassembly, memory views and plugins for analyzing programs without source code.","description_zh":"Windows 二进制调试器，通过反汇编、内存视图和插件分析没有源码的程序。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-15"},{"id":"gdb","name":"GDB","name_zh":"GDB","url":"https://sourceware.org/gdb/","evidence_url":"https://www.sourceware.org/gdb/","description_en":"Native and remote debugger for controlling execution and inspecting live or crashed program state.","description_zh":"支持本地与远程调试，可控制执行并检查运行中或崩溃后的程序状态。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-15"},{"id":"rr","name":"rr","name_zh":"rr","url":"https://github.com/rr-debugger/rr","evidence_url":"https://github.com/rr-debugger/rr/blob/7ff9786535d6b6bfab78a22bd7bb2570287b44a1/README.md","description_en":"Records process execution and replays it under GDB, enabling repeatable inspection and reverse execution.","description_zh":"记录进程执行并在 GDB 下重放，便于重复检查现场和反向执行。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-15"},{"id":"diaphora","name":"Diaphora","name_zh":"Diaphora","url":"https://github.com/joxeankoret/diaphora","evidence_url":"https://github.com/joxeankoret/diaphora/blob/a7e15949942e13e3343615c3959e3326e78aa325/README.md","description_en":"IDA-based binary diffing that matches functions and transfers names, comments and types between analyzed versions.","description_zh":"基于 IDA 的二进制差异分析工具，可匹配函数并迁移名称、注释与类型信息。","kind":"tool","category":"binary-diffing","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"bindiff","name":"BinDiff","name_zh":"BinDiff","url":"https://github.com/google/bindiff","evidence_url":"https://github.com/google/bindiff/blob/882333b463b9d98e1e5ddf221921f5622b3936e9/README.md","description_en":"Compares disassembled binaries to find matching functions and changed code across versions.","description_zh":"比较反汇编后的二进制文件，定位不同版本中的对应函数与代码变化。","kind":"tool","category":"binary-diffing","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"detect-it-easy","name":"Detect It Easy","name_zh":"Detect It Easy","url":"https://github.com/horsicq/Detect-It-Easy","evidence_url":"https://github.com/horsicq/Detect-It-Easy/blob/bd693a6c31f4e2748ca14ed01da05e055eb2b0c7/README.md","description_en":"Format-aware file identification and static inspection using parsers, signatures and programmable heuristics.","description_zh":"结合格式解析器、签名和可编程启发式规则进行文件识别与静态检查。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"ost2","name":"OpenSecurityTraining2","name_zh":"OpenSecurityTraining2","url":"https://ost2.fyi/","evidence_url":"https://ost2.fyi/Learning-Paths.html","description_en":"Free self-paced security courses with learning paths for reverse engineering, firmware and systems foundations.","description_zh":"免费的自主学习课程，提供逆向工程、固件和系统基础等学习路线。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-15"},{"id":"pwn-college-re","name":"pwn.college: Reverse Engineering","name_zh":"pwn.college：逆向工程","url":"https://pwn.college/program-security/reverse-engineering/","evidence_url":"https://pwn.college/program-security/reverse-engineering/","description_en":"Hands-on reverse-engineering module covering functions, data access, static tools and dynamic tools with hosted exercises.","description_zh":"包含托管练习的逆向工程课程，覆盖函数、数据访问、静态工具和动态工具。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-15"},{"id":"re-for-beginners","name":"Reverse Engineering for Beginners","name_zh":"逆向工程入门","url":"https://beginners.re/","evidence_url":"https://beginners.re/","description_en":"Dennis Yurichev's free book on understanding compiled programs and assembly, available in multiple languages.","description_zh":"Dennis Yurichev 编写的免费逆向入门书，以汇编与编译后程序理解为核心，提供多语言版本。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-15"},{"id":"radare2-book","name":"The Official Radare2 Book","name_zh":"radare2 官方手册","url":"https://book.rada.re/","evidence_url":"https://book.rada.re/","description_en":"Official practical reference for radare2 analysis, disassembly, scripting, debugging and related plugins.","description_zh":"radare2 官方实践参考，覆盖分析、反汇编、脚本、调试及相关插件。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-15"},{"id":"renderdoc","name":"RenderDoc","name_zh":"RenderDoc","url":"https://github.com/baldurk/renderdoc","evidence_url":"https://github.com/baldurk/renderdoc/blob/5ce2e4ae6dd54f0c8455103a2c984540614020bf/README.md","description_en":"Inspect frame captures, draw calls, shaders, and graphics resources in your own game or graphics application.","description_zh":"检查自己游戏或图形应用的帧捕获、绘制调用、着色器和图形资源。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["app","game"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"assetripper","name":"AssetRipper","name_zh":"AssetRipper","url":"https://github.com/AssetRipper/AssetRipper","evidence_url":"https://github.com/AssetRipper/AssetRipper/blob/62ec21e916b7dec29b10c2020ecead186773438b/README.md","description_en":"Analyze Unity game files, inspect asset dependencies, and convert supported assets into Unity project formats.","description_zh":"分析 Unity 游戏文件，检查资源依赖并将支持的资源转换为 Unity 工程格式。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"cpp2il","name":"Cpp2IL","name_zh":"Cpp2IL","url":"https://github.com/SamboyCoding/Cpp2IL","evidence_url":"https://github.com/SamboyCoding/Cpp2IL/blob/7fd44cac62d39914d81e10c07600ffd4110d29a9/README.md","description_en":"Recover managed representations from Unity IL2CPP builds using binary and metadata analysis; reconstruction remains a work in progress.","description_zh":"结合二进制与元数据分析，从 Unity IL2CPP 构建恢复托管表示；重建能力仍在开发中。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["app","binary","game"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"il2cppdumper","name":"Il2CppDumper","name_zh":"Il2CppDumper","url":"https://github.com/Perfare/Il2CppDumper","evidence_url":"https://github.com/Perfare/Il2CppDumper/blob/101f3c62ef3dd3183aad4ab0b547ead63ffb45d0/README.md","description_en":"Recover IL2CPP metadata and dummy assemblies, and generate helper scripts for native analysis tools; method code is not restored.","description_zh":"恢复 IL2CPP 元数据及占位程序集，为原生分析工具生成辅助脚本；不会还原方法代码。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["app","binary","game"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"renderdoc-mcp","name":"RenderDoc MCP","name_zh":"RenderDoc MCP","url":"https://github.com/scarletfantasy/renderdoc-mcp","evidence_url":"https://github.com/scarletfantasy/renderdoc-mcp/blob/ea360049b2add5e5f783bee2c084dfccf8337051/README.md","description_en":"Expose existing RenderDoc captures to an agent for bounded frame, pipeline, resource, and shader inspection.","description_zh":"向智能体开放已有 RenderDoc 捕获文件，分步检查帧、管线、资源和着色器。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app","game"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"chrome-devtools-mcp","name":"Chrome DevTools MCP","name_zh":"Chrome DevTools MCP","url":"https://github.com/ChromeDevTools/chrome-devtools-mcp","evidence_url":"https://github.com/ChromeDevTools/chrome-devtools-mcp/blob/5463101120f94fc7c79d43c44c01a4ab57835279/README.md","description_en":"Connect an agent to Chrome for live page inspection, network debugging, and performance traces.","description_zh":"连接智能体与 Chrome，检查实时页面、调试网络并记录性能轨迹。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["website"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"mitmproxy","name":"mitmproxy","name_zh":"mitmproxy","url":"https://github.com/mitmproxy/mitmproxy","evidence_url":"https://github.com/mitmproxy/mitmproxy/blob/7458ea26ccec7d06ffdc434f878e8d92973aec7e/README.md","description_en":"Inspect and record HTTP traffic with an interactive proxy, web interface, or scriptable command-line tools.","description_zh":"通过交互代理、Web 界面或可脚本化命令行检查和记录 HTTP 流量。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["app","protocol","website"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"playwright-mcp","name":"Playwright MCP","name_zh":"Playwright MCP","url":"https://github.com/microsoft/playwright-mcp","evidence_url":"https://github.com/microsoft/playwright-mcp/blob/ea00e62b711700733a9eff05b149b48cd3eb1b48/README.md","description_en":"Drive browser interactions through structured accessibility snapshots to investigate reproducible web behavior.","description_zh":"通过结构化无障碍快照驱动浏览器交互，调查可复现的网页行为。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["website"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"burp-suite-mcp-server","name":"Burp Suite MCP Server","name_zh":"Burp Suite MCP Server 扩展","url":"https://github.com/PortSwigger/mcp-server","evidence_url":"https://github.com/PortSwigger/mcp-server/blob/5f76126409780ecba2b766c7f7388f465c5b5f94/README.md","description_en":"PortSwigger's Burp Suite extension serves an MCP endpoint, plus a packaged stdio proxy, so agents can query proxy HTTP and WebSocket history, send HTTP/1.1 or HTTP/2 requests, and open Repeater or Intruder tabs.","description_zh":"PortSwigger 官方 Burp Suite 扩展，提供 MCP 端点并附带 stdio 代理，使智能体可以查询代理中的 HTTP 与 WebSocket 历史记录、发送 HTTP/1.1 或 HTTP/2 请求，并打开 Repeater 或 Intruder 标签页。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app","website"],"verified_at":"2026-10-17"},{"id":"wakaru","name":"Wakaru","name_zh":"Wakaru","url":"https://github.com/pionxzh/wakaru","evidence_url":"https://github.com/pionxzh/wakaru/blob/d77ed638d7af07500be39f512e2f058fd8d53cd1/README.md","description_en":"Recover readable modules from shipped JavaScript bundles by reversing recognized minifier and transpiler patterns. Supports bundle splitting and modern-syntax recovery for inspecting production frontend code.","description_zh":"通过还原已识别的压缩与转译模式，从发布后的 JavaScript 包中恢复可读模块，支持拆包与现代语法恢复，便于分析生产环境前端代码。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-16"},{"id":"spectral-mcp","name":"Spectral","name_zh":"Spectral","url":"https://github.com/spectral-mcp/spectral","evidence_url":"https://github.com/spectral-mcp/spectral/blob/4c0367a1e88849acfe80f3d49ba0cfc649d405c5/README.md","description_en":"Analyze captured application HTTP traffic with an LLM to generate MCP tools, OpenAPI 3.1 specifications, or GraphQL schemas. Generated tools call the observed API directly after capture and authentication setup.","description_zh":"用 LLM 分析捕获的应用 HTTP 流量，生成 MCP 工具、OpenAPI 3.1 规范或 GraphQL 模式；完成抓包与认证配置后，生成的工具可直接调用已观察到的 API。","kind":"integration","category":"web-analysis","group":"agents","relationship":"independent-agent-integration","targets":["app","protocol","website"],"verified_at":"2026-10-16"},{"id":"jsdeob-workbench","name":"jsdeob-workbench","name_zh":"jsdeob-workbench","url":"https://github.com/Owl4444/jsdeob-workbench","evidence_url":"https://github.com/Owl4444/jsdeob-workbench/blob/e51a8281cb2ee11e95c5f7cafaa2090569a91abf/README.md","description_en":"Inspect JavaScript ASTs and variable scopes while building visual chains of Babel transforms. Save analysis projects and reusable plugins to iteratively simplify obfuscated scripts.","description_zh":"在查看 JavaScript AST 和变量作用域的同时，可视化编排 Babel 转换链；保存分析项目与可复用插件，逐步简化混淆脚本。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-17"},{"id":"undertalemodtool","name":"UndertaleModTool","name_zh":"UndertaleModTool","url":"https://github.com/UnderminersTeam/UndertaleModTool","evidence_url":"https://github.com/UnderminersTeam/UndertaleModTool/blob/f43e12c445c37d50dc6244caa12ccab232983f3f/README.md","description_en":"Browse and modify supported GameMaker data files, extract assets, and decompile or compile GML VM code. Includes room editing, scripted changes, a CLI, and the reusable UndertaleModLib library.","description_zh":"浏览和修改受支持的 GameMaker 数据文件、提取资源，以及反编译或编译 GML VM 代码；提供房间编辑、脚本化修改、CLI 和可复用的 UndertaleModLib 库。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-16"},{"id":"frida-il2cpp-bridge","name":"frida-il2cpp-bridge","name_zh":"frida-il2cpp-bridge","url":"https://github.com/vfsfitvnm/frida-il2cpp-bridge","evidence_url":"https://github.com/vfsfitvnm/frida-il2cpp-bridge/blob/af361f544de8c0016d7cc24be7a87e83b3c4029d/README.md","description_en":"Inspect IL2CPP classes, methods, and fields in a live process, and trace or intercept method calls without supplying global-metadata.dat. Complements static IL2CPP dumpers with runtime observation.","description_zh":"在运行中的进程里检查 IL2CPP 类、方法和字段，无需提供 global-metadata.dat 即可跟踪或拦截方法调用，为静态 IL2CPP 转储工具补充运行时观察能力。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["app","game"],"verified_at":"2026-10-16"},{"id":"objdiff","name":"objdiff","name_zh":"objdiff","url":"https://github.com/encounter/objdiff","evidence_url":"https://github.com/encounter/objdiff/blob/eed74b99c4e94dd154882259931201badc6fdbd1/README.md","description_en":"Compare functions and data in reference and rebuilt object files to guide matching decompilation. Displays instruction-level differences, demangles C++ symbols, and can rebuild when source files change.","description_zh":"比较参考目标文件与重新编译目标文件中的函数和数据，辅助匹配反编译；显示指令级差异、还原 C++ 符号，并可在源码变更时自动重新构建。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-16"},{"id":"decomp-permuter","name":"decomp-permuter","name_zh":"decomp-permuter","url":"https://github.com/simonlindholm/decomp-permuter","evidence_url":"https://github.com/simonlindholm/decomp-permuter/blob/8556c81d80d1c1af98a858c8f4dc951357f29139/README.md","description_en":"Randomly or systematically permutes one C function, recompiling each variant and scoring it against a target object file to search for matching compiler output. PERM macros specify manual alternatives, and the optional permuter@home mode distributes runs to other workers.","description_zh":"随机或系统地改写单个 C 函数，逐个重新编译变体并与目标文件评分对比，以寻找与原编译输出一致的写法。可用 PERM 宏指定手动备选写法，可选的 permuter@home 模式能把运行分发给其他工作节点。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-17"},{"id":"asm-differ","name":"asm-differ","name_zh":"asm-differ","url":"https://github.com/simonlindholm/asm-differ","evidence_url":"https://github.com/simonlindholm/asm-differ/blob/0dd09af8f8008f1f880327cf0aca3b26d2562ea2/README.md","description_en":"Diffs original and rebuilt assembly for one function or ROM address to guide matching decompilation; its watch mode can rerun make when sources change. The README describes it as decomp.me’s default diff viewer and points to objdiff as a modern alternative.","description_zh":"对比单个函数或 ROM 地址的原始汇编与重新编译后的汇编，辅助匹配反编译；监视模式可在源码变更时重新运行 make。README 称它是 decomp.me 的默认差异查看器，并推荐 objdiff 作为现代替代方案。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-17"},{"id":"ue-explorer","name":"UE Explorer","name_zh":"UE Explorer","url":"https://github.com/UE-Explorer/UE-Explorer","evidence_url":"https://github.com/UE-Explorer/UE-Explorer/blob/9ef6670933da6154e26a9631a9e22ce9e7d3333f/README.md","description_en":"Explore Unreal packages through class, property, and dependency trees; decompile and export UnrealScript classes, inspect bytecode, and examine structured binary data.","description_zh":"通过类、属性与依赖树浏览 Unreal 包，反编译和导出 UnrealScript 类、检查字节码，并查看结构化二进制数据。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-16"},{"id":"garbro","name":"GARbro","name_zh":"GARbro","url":"https://github.com/morkt/GARbro","evidence_url":"https://github.com/morkt/GARbro/blob/b09ee4570ccb1daf6ac56710ee8934dc0b8baeb0/README.md","description_en":"Browse recognized visual-novel resource archives as folders, preview their contents, and extract images or audio with conversion to common formats.","description_zh":"像浏览文件夹一样查看已识别的视觉小说资源归档，预览内容，并在提取图像或音频时转换为常用格式。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-16"},{"id":"mobsf","name":"Mobile Security Framework (MobSF)","name_zh":"Mobile Security Framework（MobSF）","url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF","evidence_url":"https://github.com/MobSF/docs/blob/d3dc0f64b0767914c5dc6e42c8427ee645532623/running_mobsf_docker.md","description_en":"Inspect mobile application packages with static analysis and supported-device dynamic testing, including runtime behavior and network traffic, through a web interface and APIs.","description_zh":"通过 Web 界面与 API 检查移动应用包，结合静态分析及受支持设备上的动态测试，分析运行时行为与网络流量。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-16"},{"id":"objection","name":"objection","name_zh":"objection","url":"https://github.com/sensepost/objection","evidence_url":"https://github.com/sensepost/objection/blob/35c4e2c9e68a0354b21db4833252e0c4acd5bd28/pyproject.toml","description_en":"Explore running Android and iOS apps with a Frida-backed command interface for inspecting app storage, memory, runtime objects, and instrumented behavior.","description_zh":"通过基于 Frida 的命令界面探索运行中的 Android 与 iOS 应用，检查应用存储、内存、运行时对象和插桩后的行为。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-16"},{"id":"grapefruit","name":"Grapefruit","name_zh":"Grapefruit 移动应用动态插桩工具","url":"https://github.com/ChiChou/grapefruit","evidence_url":"https://github.com/ChiChou/grapefruit/blob/b7176b409793a1395503fe78153e3b0ba888f77d/README.md","description_en":"Inspect and hook running iOS and Android apps from a Frida-based web interface, with method and crypto-API hooks, filesystem and SQLite browsers, iOS keychain and UI-hierarchy views, and HTTP capture from common networking libraries.","description_zh":"通过基于 Frida 的 Web 界面检查并 Hook 运行中的 iOS 与 Android 应用，提供方法与加密 API 拦截、文件系统与 SQLite 浏览、iOS 钥匙串与界面层级查看，以及常见网络库的 HTTP 流量捕获。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-17"},{"id":"r2frida","name":"r2frida","name_zh":"r2frida","url":"https://github.com/nowsecure/r2frida","evidence_url":"https://github.com/nowsecure/r2frida/blob/4f1f8d7b1096ed0ca29778688d0f164461d56f05/README.md","description_en":"Use radare2 commands and Frida instrumentation together to inspect local or remote process memory, symbols, classes, and runtime calls on desktop and mobile targets.","description_zh":"结合 radare2 命令与 Frida 插桩，检查桌面和移动目标中本地或远程进程的内存、符号、类及运行时调用。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-16"},{"id":"emba","name":"EMBA","name_zh":"EMBA","url":"https://github.com/e-m-b-a/emba","evidence_url":"https://github.com/e-m-b-a/emba/wiki/Installation/35b42245dc59e3545a07dcc209e9ee58f8cf2590","description_en":"Extract firmware, combine static checks with emulation-based analysis, inventory software components, and generate web reports and SBOMs for further investigation.","description_zh":"提取固件，结合静态检查与仿真分析，整理软件组件清单，并生成 Web 报告和 SBOM，供进一步调查。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-16"},{"id":"fact-core","name":"Firmware Analysis and Comparison Tool (FACT)","name_zh":"固件分析与比较工具（FACT）","url":"https://github.com/fkie-cad/FACT_core","evidence_url":"https://github.com/fkie-cad/FACT_core/blob/dc594e8f2ed120b1e04aaf3c52dda201be967dff/README.md","description_en":"Unpack and analyze firmware through an extensible platform whose web interface and HTTP API make component contents and analysis results searchable and comparable across samples.","description_zh":"通过可扩展平台解包和分析固件，使用 Web 界面与 HTTP API 搜索组件内容和分析结果，并比较不同样本。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-16"},{"id":"ofrak","name":"OFRAK","name_zh":"OFRAK","url":"https://github.com/redballoonsecurity/ofrak","evidence_url":"https://github.com/redballoonsecurity/ofrak/blob/1e1ef750222c1a842248ae7bdcae576bfdedae65/README.md","description_en":"Recursively identify, unpack, analyze, modify, and repack firmware and binary formats using a resource-tree GUI and Python API, with optional disassembler backends.","description_zh":"通过资源树图形界面与 Python API，递归识别、解包、分析、修改和重新打包固件及二进制格式，并可接入可选反汇编后端。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-16"},{"id":"firmae","name":"FirmAE","name_zh":"FirmAE","url":"https://github.com/pr0v3rbs/FirmAE","evidence_url":"https://github.com/pr0v3rbs/FirmAE/blob/653565b5d14e6d69a1dd242aa88ecfb4b090a74a/README.md","description_en":"Emulate router and IP-camera firmware to inspect network services and runtime behavior, with automated emulation checks and separate analysis, run, and debugging modes.","description_zh":"仿真路由器与 IP 摄像机固件，检查网络服务和运行时行为，提供自动仿真检查，以及独立的分析、运行和调试模式。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-16"},{"id":"llm4decompile-paper","name":"LLM4Decompile (EMNLP 2024)","name_zh":"LLM4Decompile（EMNLP 2024）","url":"https://aclanthology.org/2024.emnlp-main.203/","evidence_url":"https://aclanthology.org/2024.emnlp-main.203/","description_en":"Research on direct binary decompilation and refinement of Ghidra output with language models. Evaluates re-executability on HumanEval and ExeBench; useful for distinguishing readable output from functional recovery.","description_zh":"研究使用语言模型直接反编译二进制，以及改进 Ghidra 输出。在 HumanEval 与 ExeBench 上评估重新执行能力，可用于区分代码可读性与功能恢复。","kind":"research","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-16"},{"id":"decompilebench-paper","name":"DecompileBench (Findings of ACL 2025)","name_zh":"DecompileBench（Findings of ACL 2025）","url":"https://aclanthology.org/2025.findings-acl.1194/","evidence_url":"https://aclanthology.org/2025.findings-acl.1194/","description_en":"A benchmark combining functions from real programs, runtime-aware validation, and LLM-assisted assessment of decompiled-code usability. Helps separate functional correctness from perceived understandability when comparing decompilers.","description_zh":"结合真实程序函数、运行时验证与 LLM 辅助可用性评判的反编译基准，用于比较反编译器的功能正确性与代码可理解性。","kind":"research","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-16"},{"id":"resym-paper","name":"ReSym (CCS 2024)","name_zh":"ReSym（CCS 2024）","url":"https://doi.org/10.1145/3658644.3670340","evidence_url":"https://github.com/lt-asset/resym/tree/437b4acac21a5a60edecf0c4423f7172f991271f","description_en":"Combines language models and program analysis to recover variable and user-defined data-structure symbols from stripped binaries. The authors provide training, inference, evaluation, and posterior-reasoning artifacts.","description_zh":"结合语言模型与程序分析，从去符号二进制中恢复变量和用户定义数据结构的符号信息。作者提供训练、推理、评测与后验推理材料。","kind":"research","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-16"},{"id":"lasrecomp","name":"LASRecomp: Link’s Awakening static recompilation","name_zh":"LASRecomp：《织梦岛》静态重编译案例","url":"https://github.com/peiikai/LASRecomp","evidence_url":"https://github.com/peiikai/LASRecomp/blob/6244eb9d4d3497094e21cac7dabe998ded1f2800/README.md","description_en":"A native desktop reconstruction of the 2019 Switch version of Link’s Awakening using static recompilation. The author attributes most code, tooling and reverse-engineering work to Claude Code with human direction and review.","description_zh":"通过静态重编译，将 2019 年 Switch 版《塞尔达传说：织梦岛》重建为原生桌面程序。作者称大部分代码、工具与逆向工作由 Claude Code 完成，人类负责指导和复核。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-16"},{"id":"godot-re-tools","name":"Godot RE Tools","name_zh":"Godot 逆向工程工具","url":"https://github.com/GDRETools/gdsdecomp","evidence_url":"https://github.com/GDRETools/gdsdecomp/blob/e2780fcc73ab14083967d3945e513d1f6af1dbd0/README.md","description_en":"Recover supported Godot project files, GDScript and imported resources from exported games. Includes PCK inspection and extraction, script decompilation, and resource conversion for examining and rebuilding project structure.","description_zh":"从已导出的游戏中恢复受支持的 Godot 工程文件、GDScript 与导入资源，提供 PCK 检查与提取、脚本反编译及资源转换，便于分析和重建工程结构。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-16"},{"id":"ue4ss","name":"UE4SS","name_zh":"UE4SS（虚幻引擎脚本系统）","url":"https://github.com/UE4SS-RE/RE-UE4SS","evidence_url":"https://github.com/UE4SS-RE/RE-UE4SS/blob/1ba38db4b5faf5cfad9d058a6843c12e815bc60b/README.md","description_en":"Inspect Unreal Engine games at runtime through live UObject property views, reflected C++ header dumps, property mappings and actor dumps. Lua and C++ APIs support experiments while reconstructing game structures.","description_zh":"通过实时 UObject 属性视图、反射 C++ 头文件导出、属性映射和 Actor 转储分析虚幻引擎游戏；Lua 与 C++ API 可辅助实验和重建游戏结构。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-16"},{"id":"fmodel","name":"FModel","name_zh":"FModel 游戏资源浏览器","url":"https://github.com/4sval/FModel","evidence_url":"https://github.com/4sval/FModel/blob/05cfbdd1648afe2928109b70ab63880a4bc8f7b4/README.md","description_en":"Explore Unreal Engine game archives with CUE4Parse-backed package and property inspection, asset previews and export. The 2026 summer release adds USD world export for reconstructing supported scene content.","description_zh":"基于 CUE4Parse 浏览虚幻引擎游戏归档，检查资源包和属性，预览并导出资源；2026 年夏季发行版新增 USD 世界导出，可辅助重建受支持的场景内容。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-16"},{"id":"blutter","name":"Blutter","name_zh":"Blutter","url":"https://github.com/worawit/blutter","evidence_url":"https://github.com/worawit/blutter/blob/4a60ac648bf448c5a7596437243bcd0b9376fdf0/README.md","description_en":"Analyze Flutter Android ARM64 AOT binaries using the matching Dart runtime. Produces annotated assembly, object-pool dumps and a target-specific Frida script template for investigating compiled Dart application logic.","description_zh":"利用匹配的 Dart 运行时分析 Flutter Android ARM64 AOT 二进制，生成带符号的汇编、对象池转储及面向目标的 Frida 脚本模板，辅助研究编译后的 Dart 应用逻辑。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-16"},{"id":"hermes-dec","name":"hermes-dec","name_zh":"hermes-dec","url":"https://github.com/P1sec/hermes-dec","evidence_url":"https://github.com/P1sec/hermes-dec/blob/2e796663e1fedb93dca51060797ebf3327b3fedb/README.md","description_en":"Parse, disassemble and partially decompile React Native Hermes bytecode bundles. Makes HBC headers and instructions inspectable and emits pseudocode for understanding compiled application logic.","description_zh":"解析、反汇编并部分反编译 React Native 的 Hermes 字节码包，展示 HBC 文件头和指令，并生成伪代码以帮助理解编译后的应用逻辑。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-16"},{"id":"recaf","name":"Recaf","name_zh":"Recaf 字节码分析与编辑工具","url":"https://github.com/Col-E/Recaf","evidence_url":"https://github.com/Col-E/Recaf/blob/7ce7b5d2c077d5ebaa895915df8d372b9477d5cc/README.md","description_en":"Inspect and modify compiled JVM applications with integrated decompilers, bytecode assembly, reference search, mappings and deobfuscation tools. The reviewed 4.0 preview also provides basic read-only Android bytecode inspection.","description_zh":"通过集成反编译器、字节码汇编、引用搜索、映射与去混淆工具检查和修改已编译的 JVM 应用；所审阅的 4.0 预览版还提供基础的只读 Android 字节码分析。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-16"},{"id":"kaitai-struct","name":"Kaitai Struct","name_zh":"Kaitai Struct 二进制格式描述与解析工具","url":"https://github.com/kaitai-io/kaitai_struct","evidence_url":"https://github.com/kaitai-io/kaitai_struct/blob/5ca6630c7761d7f0d9c57fd8a4af1cc8adb75a6c/README.md","description_en":"Turn documented binary layouts into reusable parsers for files and network packets. A .ksy specification can be inspected with visualizers and compiled to multiple languages, helping preserve reverse-engineered format knowledge in interoperable implementations.","description_zh":"将已描述的二进制布局转换为可复用的文件与网络报文解析器；同一份 .ksy 规范可通过可视化工具检查，并编译为多种语言，便于把逆向获得的格式知识落实为可互操作的实现。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary","firmware","protocol"],"verified_at":"2026-10-16"},{"id":"wireshark","name":"Wireshark","name_zh":"Wireshark 协议分析工具","url":"https://gitlab.com/wireshark/wireshark","evidence_url":"https://gitlab.com/wireshark/wireshark/-/blob/e1087b1870cfc7686b229836dda8838c8f45ea0f/README.md","description_en":"Inspect captured application and device traffic as decoded protocol fields, with filtering and shared GUI/TShark dissection. Custom dissectors let an analyst encode newly understood packet formats and compare protocol implementations.","description_zh":"将捕获的应用与设备流量解析为协议字段，支持过滤，并由 GUI 与 TShark 共用解析逻辑；自定义解析器可将新识别的报文格式固化下来，辅助比较协议实现。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","firmware","protocol"],"verified_at":"2026-10-16"},{"id":"pulseview","name":"PulseView","name_zh":"PulseView 信号与协议分析工具","url":"https://github.com/sigrokproject/pulseview","evidence_url":"https://github.com/sigrokproject/pulseview/blob/af02198741b4e57c9f9b796bd5e6c0f2ae9f2f2b/README","description_en":"Examine captured logic and analog waveforms with sigrok's graphical frontend. Protocol decoders and decoder stacking expose bus messages and higher-level device operations, making hardware communication traces useful for firmware and interoperability investigations.","description_zh":"通过 sigrok 的图形前端检查逻辑与模拟波形；协议解码器及分层解码可展示总线消息和更高层的设备操作，便于利用硬件通信记录开展固件与互操作性分析。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware","protocol"],"verified_at":"2026-10-16"},{"id":"uefitool","name":"UEFITool","name_zh":"UEFITool 固件镜像分析工具","url":"https://github.com/LongSoft/UEFITool","evidence_url":"https://github.com/LongSoft/UEFITool/blob/dac91b26733ca21cb204e41614c1b8c81cc50860/README.md","description_en":"Parse UEFI firmware images into an inspectable tree and check their structure. Companion UEFIExtract and UEFIFind tools extract parsed contents and locate patterns, supporting analysis of firmware components and vendor formats.","description_zh":"将 UEFI 固件镜像解析为可检查的树状结构，并检查其结构；配套的 UEFIExtract 与 UEFIFind 可提取解析后的内容、查找模式，辅助分析固件组件与厂商格式。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-16"},{"id":"browser-reverse-engineering-toolkit","name":"Browser Reverse Engineering Toolkit","name_zh":"Browser Reverse Engineering Toolkit 浏览器逆向工程工具集","url":"https://github.com/Dvurechensky/Browser.Reverse.Engineering.Toolkit","evidence_url":"https://github.com/Dvurechensky/Browser.Reverse.Engineering.Toolkit/blob/ecbe61af5004f6efa493749a623fbd98ab307a37/README.md","description_en":"Capture browser-session evidence, crawl websites in a persistent Chromium session, and generate offline architecture/API reports plus OpenAPI, SDK and mock-server drafts from saved captures.","description_zh":"采集浏览器会话证据，在持久 Chromium 会话中抓取网站，并根据已保存的捕获数据生成离线架构／API 报告，以及 OpenAPI、SDK 和模拟服务器草稿。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-16"},{"id":"screenshot-to-code","name":"screenshot-to-code","name_zh":"screenshot-to-code 截图转前端代码工具","url":"https://github.com/abi/screenshot-to-code","evidence_url":"https://github.com/abi/screenshot-to-code/blob/a8139779f7c5ae231b7f2a86fa7f83ddc5f7badc/README.md","description_en":"Generate HTML/CSS, Tailwind, React, Vue, Bootstrap or Ionic front-end code from screenshots, mockups, Figma designs or screen recordings with multimodal models; an optional headless-browser preview lets the model check its rendered output. The result is a visual reconstruction of the interface, not recovered original source or backend behavior.","description_zh":"借助多模态模型，根据截图、设计稿、Figma 设计或屏幕录像生成 HTML/CSS、Tailwind、React、Vue、Bootstrap 或 Ionic 前端代码；可选的无头浏览器预览可让模型渲染并自查输出。结果是对界面外观的视觉重建，并非恢复原始源码或后端行为。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-17"},{"id":"nibkit","name":"nibkit","name_zh":"nibkit 原生界面结构分析工具","url":"https://github.com/tokenbleed/nibkit","evidence_url":"https://github.com/tokenbleed/nibkit/blob/fcf4670db8ba5d5d94ab62951a971be949b7b21f/README.adoc","description_en":"Decode compiled iOS/macOS interface archives into object trees, Outlet/Action connections, custom classes and navigation relationships. Exports JSON or Mermaid diagrams and exposes read-only inspection commands through MCP.","description_zh":"将已编译的 iOS/macOS 界面归档解码为对象树、Outlet／Action 连接、自定义类及导航关系，可导出 JSON 或 Mermaid 图，并通过 MCP 提供只读检查命令。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-16"},{"id":"psp-web-recomp","name":"PSP Web Recomp","name_zh":"PSP Web Recomp 浏览器游戏重编译项目","url":"https://github.com/snuri00/psp-web-recomp","evidence_url":"https://github.com/snuri00/psp-web-recomp/blob/37826ab881d9a593efb842fe47adfae2e9118b5d/README.md","description_en":"Translate PSP MIPS executables into C++ and WebAssembly, backed by a PSP high-level emulation runtime and WebGL2 renderer. Native tracing, frame capture and audio tools support investigating missing behavior during game porting.","description_zh":"将 PSP MIPS 可执行文件转换为 C++ 与 WebAssembly，配合 PSP 高层仿真运行时和 WebGL2 渲染器；原生跟踪、画面捕获及音频工具可辅助调查游戏移植中缺失的行为。","kind":"project","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game","website"],"verified_at":"2026-10-16"},{"id":"n64recomp","name":"N64: Recompiled","name_zh":"N64: Recompiled","url":"https://github.com/N64Recomp/N64Recomp","evidence_url":"https://github.com/N64Recomp/N64Recomp/blob/ffb39cdad1da5de07eaaa48bd1db4a89a7986771/README.md","description_en":"Statically recompiles N64 MIPS binaries into C functions from symbol metadata, emitting function lookups and relocation macros so a runtime can handle statically linked and relocatable overlays. The output needs a runtime such as N64ModernRuntime; the repository also includes RSP microcode and mod tooling.","description_zh":"依据符号元数据将 N64 MIPS 二进制静态重编译为 C 函数，并生成函数查找与重定位宏，供运行时处理静态链接和可重定位的覆盖段。输出需配合 N64ModernRuntime 等运行时；仓库还包含 RSP 微码重编译与模组工具。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-17"},{"id":"xenonrecomp","name":"XenonRecomp","name_zh":"XenonRecomp","url":"https://github.com/hedge-dev/XenonRecomp","evidence_url":"https://github.com/hedge-dev/XenonRecomp/blob/ddd128bcca99fe8bfbb99bea583c972351fa6ace/README.md","description_en":"Converts Xbox 360 PowerPC executables into C++ that can be compiled for other platforms, with the XenonAnalyse companion detecting jump tables and function boundaries. Output is a literal instruction translation rather than decompiled code and needs a runtime that the project does not supply.","description_zh":"将 Xbox 360 PowerPC 可执行文件转换为可在其他平台编译的 C++ 代码，配套的 XenonAnalyse 负责检测跳转表和函数边界。输出是逐条指令的直译而非反编译代码，并需要项目本身不提供的运行时。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-17"},{"id":"aotopsy","name":"AOTopsy","name_zh":"AOTopsy Flutter/Dart 静态分析工具","url":"https://github.com/BroNils/aotopsy","evidence_url":"https://github.com/BroNils/aotopsy/blob/01011df108eaf5a0c1757cf5842115f9fb8b6303/README.md","description_en":"Statically inspect Flutter/Dart AOT libapp.so files to recover available metadata, class structures, call edges and pseudocode without embedding a Dart VM or compiling a matching SDK. Supports ARM64 and x86_64 analysis paths.","description_zh":"静态检查 Flutter/Dart AOT libapp.so 文件，恢复可用元数据、类结构、调用关系及伪代码，无需嵌入 Dart VM 或编译匹配的 SDK，提供 ARM64 与 x86_64 分析路径。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-16"},{"id":"hbctool","name":"hbctool","name_zh":"hbctool Hermes 字节码汇编与反汇编工具","url":"https://github.com/bongtrop/hbctool","evidence_url":"https://github.com/bongtrop/hbctool/blob/389b351bfdd988e93da5cce1a9e3bfd860548e7a/README.md","description_en":"Disassemble and reassemble supported React Native Hermes bytecode bundles through HASM files, enabling bytecode inspection and editing for the explicitly supported legacy HBC versions.","description_zh":"通过 HASM 文件反汇编和重新汇编受支持的 React Native Hermes 字节码包，为明确支持的旧版 HBC 提供字节码检查与修改能力。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-16"},{"id":"kef-lsx-volume-case","name":"LSX II Volume Fixer: reconstructing volume behavior","name_zh":"LSX II 音量修正器：重建音量行为","url":"https://github.com/roberdorfer/kef-lsx-volume","evidence_url":"https://github.com/roberdorfer/kef-lsx-volume/blob/6fbd7f76c63bf6d7da0979db4a1b312a064e0b4b/README.md","description_en":"Uses measured USB-volume behavior and a macOS audio proxy to map volume keys to a KEF LSX II’s LAN control. The project reports more even steps while forwarding USB audio; the speaker firmware is unchanged.","description_zh":"根据实测 USB 音量行为，通过 macOS 音频代理将音量键映射到 KEF LSX II 的局域网控制。项目报告音量步进更均匀，同时转发 USB 音频；扬声器固件未修改。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-16"},{"id":"arkweb-two-game-case","name":"ArkWeb: a two-game movement and collision experiment","name_zh":"ArkWeb：双游戏动作与碰撞桥接实验","url":"https://github.com/luki-1/ArkWeb","evidence_url":"https://github.com/luki-1/ArkWeb/blob/17ec697bd431fce96a60fff1075f7e399d296058/README.md","description_en":"Runs Spider-Man Remastered and Arkham Knight together, streaming Gotham collision into Spider-Man’s physics world and compositing his rendered frame into Arkham. This experimental runtime bridge is not a recovered standalone game or new engine.","description_zh":"同时运行《漫威蜘蛛侠：重制版》与《蝙蝠侠：阿卡姆骑士》，将哥谭碰撞数据传入蜘蛛侠的物理世界，再将其渲染画面合成到阿卡姆中。这是实验性的运行时桥接，并非恢复出的独立游戏或新引擎。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-16"},{"id":"hw-harness-reference-case","name":"hw-harness: scanner USB protocol investigation","name_zh":"hw-harness：扫描仪 USB 协议调查","url":"https://github.com/cschalle/hw-harness","evidence_url":"https://github.com/cschalle/hw-harness/blob/093afc5c576c200f29b771d01624a327d0ff1806/examples/plustek-film-scanner/README.md","description_en":"Documents an author-reported scanner investigation comparing vendor-driver USB control transfers with Linux-driver traces to infer initialization, timing and resolution parameters. The released harness organizes reference capture and comparison; it does not automatically recover a complete protocol specification.","description_zh":"记录作者报告的扫描仪调查：比较厂商驱动的 USB 控制传输与 Linux 驱动的记录，推断初始化、时序及分辨率参数。公开工具负责组织参考采集与比较，并不自动恢复完整协议规范。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-17T02:37:34.781877Z"},{"id":"netzob","name":"Netzob","name_zh":"Netzob 协议建模与推断框架","url":"https://github.com/netzob/netzob","evidence_url":"https://github.com/netzob/netzob/blob/088fe769e98e0bfbd3ed99e66b3982446bf8d197/README.rst","description_en":"Model communication protocols and infer message layouts from traces, with configured active learning for protocol state machines. Python APIs expose message fields, symbols and automata for parsing, traffic generation and fuzzing.","description_zh":"对通信协议建模并从流量记录推断报文布局，通过配置主动学习来推断协议状态机。Python API 提供报文字段、符号和自动机，用于解析、流量生成及模糊测试。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-17T02:53:06.350416Z"},{"id":"scapy","name":"Scapy","name_zh":"Scapy 报文分析与构造工具","url":"https://github.com/secdev/scapy","evidence_url":"https://github.com/secdev/scapy/blob/e2e35c07bce2f40e7513e1b29a6d300d5329dbc3/README.md","description_en":"Script packet dissection, construction, request/reply matching and capture-file analysis in Python. Custom packet fields and layer bindings let analysts encode understood wire formats and investigate protocol behavior.","description_zh":"使用 Python 编写报文解析、构造、请求／响应匹配及捕获文件分析流程；自定义报文字段与层绑定可将已理解的线格式编码为可操作模型，辅助研究协议行为。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-17T02:53:06.350416Z"},{"id":"universal-radio-hacker","name":"Universal Radio Hacker (URH)","name_zh":"Universal Radio Hacker（URH）无线协议分析工具","url":"https://github.com/jopohl/urh","evidence_url":"https://github.com/jopohl/urh/blob/1403d92987cc3d01d41aff64250955ce455dabd2/README.md","description_en":"Demodulate and decode signals captured with software-defined radios, with automatic modulation-parameter detection and customizable decodings. Analysts assign protocol fields and message types by hand or review rule-based automatic field inference; a fuzzer targets stateless protocols and a simulator supports stateful exchanges.","description_zh":"解调并解码通过软件无线电捕获的信号，支持自动检测调制参数和自定义解码。分析者可手动标注协议字段与消息类型，或复核基于规则的字段自动推断结果；模糊测试组件面向无状态协议，仿真环境则用于有状态交互。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"savvycan","name":"SavvyCAN","name_zh":"SavvyCAN CAN 总线分析工具","url":"https://github.com/collin80/SavvyCAN","evidence_url":"https://github.com/collin80/SavvyCAN/blob/3166d8cc6c8d12c2c7db78d96b24fc0f8bced1ef/README.md","description_en":"Capture or load CAN bus traffic and investigate frames with sniffer, graphing, file-comparison and ISO-TP/UDS decoding views; loaded or analyst-edited DBC files map raw bytes to named signals. Separate custom-sender, fuzzing and UDS-scan windows transmit frames on a live bus.","description_zh":"捕获或载入 CAN 总线流量，通过嗅探、绘图、文件比对及 ISO-TP／UDS 解码视图分析帧；借助载入或由分析者编辑的 DBC 文件，将原始字节映射为具名信号。自定义发送、模糊测试和 UDS 扫描则是独立窗口，会主动向实时总线发送帧。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"aalpy","name":"AALpy","name_zh":"AALpy 自动机学习库","url":"https://github.com/DES-Lab/AALpy","evidence_url":"https://github.com/DES-Lab/AALpy/blob/335c50a1b4b5a830d788f86b7c30a8cb6c73ecc0/README.md","description_en":"General-purpose Python automata-learning library that infers deterministic, non-deterministic, stochastic and pushdown models of black-box systems from active queries or passive traces. Its README links a separate Bluetooth Low Energy study whose repository reports learned connection and legacy-pairing state machines; message formats are not inferred.","description_zh":"通用的 Python 自动机学习库，可通过主动查询或被动轨迹数据，推断黑盒系统的确定性、非确定性、随机及下推自动机模型。其 README 链接了一项独立的低功耗蓝牙（BLE）研究，该研究的仓库报告了学习得到的设备连接与传统配对（legacy pairing）状态机；该库本身不推断报文格式。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"glasgow-interface-explorer","name":"Glasgow Interface Explorer","name_zh":"Glasgow Interface Explorer 数字接口探索工具","url":"https://github.com/GlasgowEmbedded/glasgow","evidence_url":"https://github.com/GlasgowEmbedded/glasgow/blob/d51713b2141bba7958a073e99166ad01f5024c42/docs/manual/src/intro.rst","description_en":"Use FPGA-based open hardware and Python applets to read and write SPI flash, I2C EEPROM and parallel memory chips, determine JTAG pinouts, debug supported processors and analyze UART, SPI and QSPI transactions on physical devices.","description_zh":"借助基于 FPGA 的开源硬件和 Python 小程序（applet），读写 SPI 闪存、I2C EEPROM 及并行存储芯片，自动确定 JTAG 引脚，调试受支持的处理器，并分析实体设备上的 UART、SPI 和 QSPI 事务。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware","protocol"],"verified_at":"2026-10-17"},{"id":"penguin","name":"Penguin","name_zh":"Penguin 固件重托管工具","url":"https://github.com/rehosting/penguin","evidence_url":"https://github.com/rehosting/penguin/blob/b645cd23852a41781181a651779b82a48c0c3fd3/README.md","description_en":"Rehost embedded Linux firmware from an extracted root filesystem using a generated, editable configuration of emulation transformations, then refine it through a guest root shell, forwarded network services and recorded dynamic-analysis output.","description_zh":"以提取出的根文件系统为输入，生成可编辑的仿真变换配置来重托管嵌入式 Linux 固件，再借助客户机 root shell、转发到主机的网络服务和记录下的动态分析输出，逐步完善配置。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-17"},{"id":"pyghidra-mcp","name":"pyghidra-mcp","name_zh":"pyghidra-mcp 项目级 Ghidra MCP 服务器","url":"https://github.com/clearbluejar/pyghidra-mcp","evidence_url":"https://github.com/clearbluejar/pyghidra-mcp/blob/323fbdb29dfed42241e6574806223a3454aca908/README.md","description_en":"PyGhidra-based MCP server that analyzes every binary in a Ghidra project and exposes decompilation, cross-references, call graphs, symbol and string search, indexed semantic code search, and renaming, typing and comment edits. A separate HTTP CLI client and an optional mode driving a Ghidra GUI it launches are included.","description_zh":"基于 PyGhidra 的 MCP 服务器，可分析 Ghidra 项目中的全部二进制，提供反编译、交叉引用、调用图、符号与字符串搜索、基于索引的语义代码检索，以及重命名、类型和注释编辑。另附基于 HTTP 的独立命令行客户端，以及可选的图形界面模式：由服务器自行启动 Ghidra 图形界面并加以操控。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-17"},{"id":"goresym","name":"GoReSym","name_zh":"GoReSym Go 符号恢复工具","url":"https://github.com/mandiant/GoReSym","evidence_url":"https://github.com/mandiant/GoReSym/blob/722897e0a80da0a06c00c5e40591a253a551f04e/README.md","description_en":"Recover Go build metadata, function names and address ranges, source file and line tables, embedded types and strings from Go binaries, including stripped and some malformed unpacked samples. JSON output can be imported into IDA Pro with the included IDAPython script.","description_zh":"从 Go 二进制中恢复构建元数据、函数名与地址范围、源文件和行号表、内嵌类型及字符串，也可处理已剥离符号以及部分经 UPX 等脱壳后结构异常的样本。JSON 输出可借助附带的 IDAPython 脚本导入 IDA Pro。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-17"},{"id":"revng","name":"rev.ng","name_zh":"rev.ng 二进制分析框架与反编译器","url":"https://github.com/revng/revng","evidence_url":"https://github.com/revng/revng/blob/57d81a3b0d946ccaa9fed8a13c9871dc36b94747/share/doc/revng/what-is-revng.md","description_en":"Open-source decompilation pipeline that lifts x86-64, AArch64, i386, ARM and MIPS code with QEMU, runs LLVM-based analyses and emits C designed to be valid and recompilable. Data layout analysis infers structures from pointer use; an editable YAML model and Python or TypeScript wrappers support automation. Its VSCode-based UI is a separate closed-beta product, with commercial plans announced.","description_zh":"开源反编译流水线：借助 QEMU 将 x86-64、AArch64、i386、ARM 和 MIPS 代码提升为与架构无关的表示，以 LLVM 进行分析，并输出以合法、可重新编译为设计目标的 C 代码。数据布局分析可根据指针用法推断数据结构；可编辑的 YAML 模型及 Python、TypeScript 封装便于自动化。基于 VSCode 的界面是单独的产品，目前处于封闭测试阶段，并计划推出商业方案。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-17"},{"id":"leanrea-skill","name":"LeanREA","name_zh":"LeanREA 命令行逆向分析技能","url":"https://github.com/aicodeking/leanrea","evidence_url":"https://github.com/aicodeking/leanrea/blob/09ba4aa0217f82cd880f855a60b877f59f39b22b/README.md","description_en":"An independent agent skill that routes application and binary investigations through ordinary command-line tools. It supplies batched triage recipes, targeted source/disassembly reading and explicit seen/inferred/unknown evidence labels, accompanied by a small author-reported comparison against an REA MCP workflow.","description_zh":"独立智能体技能，使用普通命令行工具开展应用与二进制调查，提供批量初查、针对性源码／反汇编阅读，以及明确的已观察／推断／未知证据标记，并附有作者报告的 REA MCP 工作流小规模对照。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["app","binary"],"verified_at":"2026-10-17"},{"id":"uu-remote-linux-protocol-case","name":"UU Remote on Linux: an unofficial protocol implementation","name_zh":"Linux 上的 UU 远程：非官方协议实现","url":"https://github.com/VallierDev/uu-remote-linux","evidence_url":"https://github.com/VallierDev/uu-remote-linux/blob/696cf10e334b2e7fe1afcb698b354c09ee328447/README.en.md","description_en":"Implements an unofficial native Linux host for NetEase UU Remote, using protocol behavior the maintainer says was recovered from official-client traffic and shipped programs. The Rust implementation connects selected desktop, input and auxiliary-tool channels to Linux services; an additional Linux viewer remains experimental. The author attributes development to Claude and Codex, without establishing REA use.","description_zh":"实现网易 UU 远程的非官方原生 Linux 被控端；维护者称协议行为来自对官方客户端流量及已发布程序的调查。Rust 实现将选定的桌面、输入和辅助工具通道连接到 Linux 服务，另有仍处于实验阶段的 Linux 控制端。作者将开发归因于 Claude 与 Codex，未确立 REA 使用。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"perfect-dark-matching-decomp-case","name":"Perfect Dark: matching Nintendo 64 decompilation","name_zh":"Perfect Dark：生成一致 ROM 的 Nintendo 64 反编译重建","url":"https://github.com/n64decomp/perfect_dark","evidence_url":"https://github.com/n64decomp/perfect_dark/blob/169ed48bdcbfb3b568b028bd5bebb27680073514/README.md","description_en":"Reconstructs Perfect Dark’s Nintendo 64 code with a documented matching-ROM build. The project combines reconstructed source with assets from a user-supplied original ROM, then checks version-specific artifact hashes. It is a reproducible-build research case, distinct from the separate native PC port; matching results remain project-reported here.","description_zh":"重建 Perfect Dark 的 Nintendo 64 代码，并提供生成一致 ROM 的构建流程。项目将重建源码与使用者自备原 ROM 中的素材结合，再检查各版本产物的哈希。这是可复现构建研究案例，与独立的原生 PC 移植不同；此处的一致性结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"tclimate-cloud-controls-case","name":"TCLimate: reconstructing selected TCL Home cloud controls","name_zh":"TCLimate：重建选定的 TCL Home 云端控制","url":"https://github.com/umarz317/TCLimate","evidence_url":"https://github.com/umarz317/TCLimate/blob/2a33c2013dbf3f297238131ca9eb6e287b2beb67/Docs/Investigation.md","description_en":"Implements selected TCL Home air-conditioner controls and electricity reporting in a native macOS menu-bar app. It adapts earlier community protocol work and documents an Android-module investigation to recover a separate statistics request. Reported validation checks cloud state, not independent physical operation or complete device equivalence.","description_zh":"在原生 macOS 菜单栏应用中实现选定的 TCL Home 空调控制与用电量报告。项目改编既有社区协议实现，并记录通过调查 Android 模块恢复另一条统计请求的过程。报告的验证检查云端状态，不等于独立核实设备实际运行或完整设备等价性。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"universal-modder-agent-toolkit","name":"Universal Modder","name_zh":"Universal Modder 游戏模组智能体工具包","url":"https://github.com/rehan-remade/universal-modder","evidence_url":"https://github.com/rehan-remade/universal-modder/blob/6a8865ae171b406f50892c7f46fc5f45655269eb/README.md","description_en":"Packages agent skills, three role briefs, a Python CLI and preconfigured fal MCP settings for modding PC games the user owns. Its reverse-engineering guidance sends managed, native and data-format work to external decompilers and debuggers, and requires a round-trip check before a reverse-engineered file format is used; one worked example ships an Age of Empires II sprite writer built this way. It is a modding toolkit with agent-written field notes, not a game decompilation, and its example results remain project-reported.","description_zh":"为修改用户自有的 PC 游戏打包智能体技能、三份角色说明、Python 命令行工具及预配置的 fal MCP 设置。其逆向分析指南把托管代码、原生代码和数据格式工作交给外部反编译器与调试器，并要求逆向得到的文件格式先通过往返检查再投入使用；其中一个示例附带按此方法实现的 Age of Empires II 精灵写入器。它是附带智能体实践笔记的模组工具包，不是游戏反编译重建，示例结果仍为项目报告。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["game"],"verified_at":"2026-10-18"},{"id":"browserbase-claude-chrome-bridge-case","name":"Browserbase plugin: re-hosting Claude in Chrome’s browser bridge","name_zh":"Browserbase 插件：将 Claude in Chrome 浏览器桥接转接到云端","url":"https://github.com/browserbase/claude-code-plugin","evidence_url":"https://github.com/browserbase/claude-code-plugin/blob/b399af34a1b1cc365d1e1c0089823c4fa5e10ea5/forwarding-server.js","description_en":"Stands in for the Claude in Chrome extension side of Claude Code’s local browser bridge and runs the requested actions in Browserbase cloud browsers. The author’s thread describes the reverse-engineered framing, a 4-byte little-endian length before each JSON tool call, and the plugin maps 17 named tools onto Stagehand/CDP operations. It is an archived interoperability shim with several placeholder tools, not recovered Anthropic code or a verified equivalent of the extension.","description_zh":"在 Claude Code 本地浏览器桥接中替代 Claude in Chrome 扩展一端，把请求的操作交给 Browserbase 云端浏览器执行。作者的帖子串描述了逆向得到的消息格式，即每条 JSON 工具调用前加 4 字节小端长度；插件则将 17 个具名工具映射为 Stagehand／CDP 操作。这是已归档的互操作适配层，部分工具仅为占位实现，并非恢复出的 Anthropic 代码，也未经验证与扩展等价。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"visor-ray-ban-meta-client-case","name":"Visor: an independent Ray-Ban Meta glasses client","name_zh":"Visor：独立的 Ray-Ban Meta 眼镜客户端","url":"https://github.com/macedonga/visor","evidence_url":"https://github.com/macedonga/visor/blob/8caaa12df919c014c249efb71fdfa32b263f6c3e/README.md","description_en":"Implements an Android replacement for the Meta AI companion app that speaks the Ray-Ban Meta glasses’ own Bluetooth and Wi-Fi Direct protocol, imports media, exposes settings and answers “Hey Meta” with a model the user chooses. The project wiki documents the link layers, encryption, services and Meta-side ownership steps, and lists 153 open questions. Testing is on real glasses rather than test suites, so behavior beyond the stated model and firmware remains unverified.","description_zh":"实现可替代 Meta AI 配套应用的 Android 客户端：直接使用 Ray-Ban Meta 眼镜自有的蓝牙与 Wi-Fi Direct 协议，导入媒体、提供设置，并用用户选择的模型回应“Hey Meta”。项目 wiki 记录了链路分层、加密、服务及 Meta 端的所有权流程，并列出 153 个未解问题。项目以实机试用代替测试套件，因此所述型号和固件之外的行为仍未经验证。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"sms-pc-port-case","name":"Super Mario Sunshine: a native PC port from an AI-assisted decompilation","name_zh":"Super Mario Sunshine：基于 AI 辅助反编译的原生 PC 移植","url":"https://github.com/chasem-dev/sms-pc-port","evidence_url":"https://github.com/chasem-dev/sms-pc-port/blob/a2ff4eef099b22b2af487d1b5e3ac09ffe667d31/README.md","description_en":"Builds a native PC port of Super Mario Sunshine’s North American release from a pinned matching-decompilation fork, adding a host platform layer for graphics, disc, audio, input and OS services. The fork’s README says AI was used extensively to reconstruct and match its code; the port documents scripted regression hashes and lockstep comparisons with retail captures. Functions that do not yet match can still behave differently from retail, and the game must come from the user’s own disc image.","description_zh":"以固定版本的一致性反编译分支为基础，构建 Super Mario Sunshine 北美版的原生 PC 移植，并为图形、光盘、音频、输入和系统服务提供宿主平台层。该分支的 README 称，其代码的重建与匹配大量借助 AI；移植项目记录了脚本化回归哈希，以及与原版捕获数据的逐步对照。尚未匹配的函数仍可能与原版行为不同，游戏数据须来自使用者自己的光盘镜像。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"zelda-mm-decomp-case","name":"Majora’s Mask: matching US N64 decompilation","name_zh":"《姆吉拉的假面》：生成一致美版 N64 ROM 的反编译重建","url":"https://github.com/zeldaret/mm","evidence_url":"https://github.com/zeldaret/mm/blob/bf6bd9d0d3a90fe2f8960e034fbfd328e8bdef22/README.md","description_en":"Recreates a C source base for The Legend of Zelda: Majora’s Mask from information in the game and static or dynamic analysis, then rebuilds the US Nintendo 64 ROM. The build takes assets and assembly from a user-supplied ROM and checks the output against stored MD5 checksums. The team states it will not produce a PC port; the separately curated Zelda 64: Recompiled only credits it for headers and some functions.","description_zh":"依据游戏内信息和静态或动态分析，为《塞尔达传说：姆吉拉的假面》重建 C 源码库，并重新构建美版 Nintendo 64 ROM。构建流程从使用者自备的 ROM 中取得素材和汇编，再用仓库保存的 MD5 校验输出。团队声明不会制作 PC 移植；另行收录的 Zelda 64: Recompiled 只注明借用了其头文件和部分函数。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"wine-uwp-store-apps-case","name":"wine-uwp: running packaged Windows Store apps on a patched Wine","name_zh":"wine-uwp：在修改版 Wine 上运行打包的 Windows 商店应用","url":"https://github.com/designgears/wine-uwp","evidence_url":"https://github.com/designgears/wine-uwp/blob/1cf79d025e0c18167de803820345a1c5f82fd17d/README.md","description_en":"Extends Wine 11.17 so that signed MSIX Store apps, with Shapr3D as the main target, install and run on Linux without their source or symbols. About 49,000 changed lines add a DirectComposition implementation, composition swap chains and an app-model host, while Microsoft’s own XAML and app-model DLLs, harvested from a Windows 11 image on the user’s machine, run unmodified. The author says Claude did most of the reverse engineering and code; app support is uneven and checked by a project regression suite.","description_zh":"扩展 Wine 11.17，使已签名的 MSIX 商店应用（主要目标为 Shapr3D）无需源码或符号即可在 Linux 上安装运行。约 49,000 行改动新增了 DirectComposition 实现、合成交换链和应用模型宿主；微软自己的 XAML 与应用模型 DLL 则在使用者机器上从 Windows 11 镜像中提取后原样运行。作者称大部分逆向工程和代码由 Claude 完成；各应用支持程度不一，由项目回归测试检查。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-18"},{"id":"dlssnr-amd-neural-rendering-case","name":"DLSSNR-AMD: reimplementing DLSS 5 neural rendering for RDNA4","name_zh":"DLSSNR-AMD：为 RDNA4 重新实现 DLSS 5 神经渲染","url":"https://github.com/mochizuki0323/DLSSNR-AMD","evidence_url":"https://github.com/mochizuki0323/DLSSNR-AMD/blob/ab00d2b23584de0f42ac91eca4d7d2d2fad11465/README.md","description_en":"Reimplements the neural-rendering network of NVIDIA’s DLSS 5 library as Vulkan compute shaders for AMD RX 9000 (RDNA4) cards and supplies it to games through an NGX-compatible core and ReShade or Vulkan-layer routes. The weights are not distributed: installers extract them, hash-checked, from the user’s own nvngx_dlssnr.dll 310.9.16 or 310.8.0. The project compares its output with NVIDIA’s DLL on an RTX 5090 and reports close, not bit-identical, pictures.","description_zh":"将 NVIDIA DLSS 5 库中的神经渲染网络重新实现为面向 AMD RX 9000（RDNA4）显卡的 Vulkan 计算着色器，并通过兼容 NGX 的核心模块以及 ReShade 或 Vulkan 层等途径提供给游戏。项目不分发权重：安装程序从使用者自己的 nvngx_dlssnr.dll 310.9.16 或 310.8.0 中提取权重并核对哈希。项目将输出与 NVIDIA DLL 在 RTX 5090 上的结果对比，报告画面接近但并非逐位一致。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"botw-decomp-case","name":"Breath of the Wild: per-function matching decompilation of the Switch executable","name_zh":"《旷野之息》：Switch 主程序的逐函数一致性反编译","url":"https://github.com/zeldaret/botw","evidence_url":"https://github.com/zeldaret/botw/blob/e78c02499d0f108ae9c00158198289764c5980fe/README.md","description_en":"Reimplements part of Breath of the Wild’s Switch v1.5.0 main executable in C++ and checks each function against the original machine code. The project calls itself a hybrid decompilation/reimplementation: it contains no assets, its ELF holds only reimplemented functions and cannot run the game, and porting is an explicit non-goal.","description_zh":"以 C++ 重新实现《塞尔达传说 旷野之息》Switch v1.5.0 主程序的部分代码，并逐个函数与原始机器码比对。项目自称是反编译与重新实现的混合体：不含游戏素材，生成的 ELF 仅包含已重新实现的函数、无法运行游戏，移植到其他平台也明确不是目标。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"skyward-sword-decomp-case","name":"Skyward Sword: Wii decompilation with hash-checked relinking","name_zh":"《天空之剑》：以哈希校验重新链接的 Wii 版反编译","url":"https://github.com/zeldaret/ss","evidence_url":"https://github.com/zeldaret/ss/blob/d3d8e3cbf3d353b2231f06690965cac5366e28a1/README.md","description_en":"Reconstructs C++ source for The Legend of Zelda: Skyward Sword’s Wii main.dol and REL modules, starting from the user’s NTSC-U 1.0 (SOUE01) disc files. Objects marked matching are compiled from source and linked with objects split from the original, and the result is checked against SHA-1 hashes; the repository ships no assets or assembly and is not a port.","description_zh":"以使用者自备的 NTSC-U 1.0（SOUE01）光盘文件为起点，为《塞尔达传说 天空之剑》Wii 版的 main.dol 和 REL 模块重建 C++ 源码。标为一致的对象由源码编译，再与从原文件拆分出的其余对象链接，并以 SHA-1 哈希校验结果；仓库不含素材或汇编，也不是移植。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"2ship2harkinian-mm-port-case","name":"2 Ship 2 Harkinian: a native Majora’s Mask port built on the decompilation","name_zh":"2 Ship 2 Harkinian：基于反编译的《姆吉拉的假面》原生移植","url":"https://github.com/2ship2harkinian/2ship2harkinian","evidence_url":"https://github.com/2ship2harkinian/2ship2harkinian/blob/f1dda4c28cb9ed7cc80d8c78337ee31a8d2c7d0e/README.md","description_en":"Builds native Windows, Linux and macOS versions of The Legend of Zelda: Majora’s Mask from an adapted copy of the zeldaret/mm decompilation, with libultraship reimplementing N64 SDK functions. Game data comes from a user-supplied ROM and is packed into an archive that custom asset packs can override. It targets a playable PC port with enhancements, not a byte-identical ROM.","description_zh":"以改编自 zeldaret/mm 反编译的源码为基础，构建《塞尔达传说：姆吉拉的假面》的原生 Windows、Linux 和 macOS 版本，并由 libultraship 重新实现 N64 SDK 函数。游戏数据来自使用者自备的 ROM，打包为可被自定义素材包覆盖的存档文件。它面向带增强功能的可玩 PC 移植，而不是逐字节一致的 ROM。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ship-of-harkinian-oot-port-case","name":"Ship of Harkinian: a native Ocarina of Time port built on the decompilation","name_zh":"Ship of Harkinian：基于反编译源码的《时之笛》原生移植","url":"https://github.com/HarbourMasters/Shipwright","evidence_url":"https://github.com/HarbourMasters/Shipwright/blob/dd702b0679f2240209763d00277e7343ee1424b9/README.md","description_en":"Builds Ocarina of Time as a native PC application from the OoT decompilation’s source, with libultraship standing in for the N64 libultra SDK and DirectX 11, OpenGL or Metal rendering. No game assets are shipped: they are converted from the user’s supported ROM into an .o2r archive, and the port adds save states, alternate and custom assets and other enhancements.","description_zh":"以《时之笛》反编译项目的源码为基础，将游戏构建为原生 PC 程序，用 libultraship 替代 N64 的 libultra SDK，并以 DirectX 11、OpenGL 或 Metal 渲染。不随附游戏素材，而是从使用者自备的受支持 ROM 转换生成 .o2r 归档；移植版还加入了即时存档、替换与自定义素材等增强功能。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"zelda-tmc-decomp-case","name":"The Minish Cap: a GBA decompilation targeting five ROMs","name_zh":"《缩小帽》：面向五个 ROM 的 GBA 反编译重建","url":"https://github.com/zeldaret/tmc","evidence_url":"https://github.com/zeldaret/tmc/blob/6fb6dfb4a7efbe24d0fd1dda5097af6131faacde/README.md","description_en":"Recreates a C source base for The Legend of Zelda: The Minish Cap from information in the game and static or dynamic analysis, building five Game Boy Advance ROMs: USA, EU, JP and two demos. Each version takes its assets from a user-supplied original ROM, and normal builds check the output’s SHA-1 hash. The project remains a work in progress, and some parts of the ROM may not yet be shiftable.","description_zh":"依据游戏内信息和静态或动态分析，为《塞尔达传说：缩小帽》重建 C 源码库，可构建美版、欧版、日版及两个演示版共五个 Game Boy Advance ROM。每个版本的素材都来自使用者自备的原始 ROM，常规构建会核对产物的 SHA-1 哈希。项目仍在进行中，ROM 的部分内容可能尚不能移动。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ocarina-of-time-decomp-case","name":"Ocarina of Time: decompilation with MD5-checked ROM builds for 16 versions","name_zh":"《时之笛》：16 个版本均以 MD5 校验 ROM 构建的反编译","url":"https://github.com/zeldaret/oot","evidence_url":"https://github.com/zeldaret/oot/blob/8a3634ca774a9b58d822cbc2cc09309f31eac6a4/README.md","description_en":"Recreates a C source base for Ocarina of Time that rebuilds 16 Nintendo 64, GameCube and iQue Player ROM versions, using information from the game and static and dynamic analysis. Assets come from the user’s own ROM and each default build is checked against that version’s MD5; README states the project is not producing a PC port and still calls the repository a work in progress.","description_zh":"借助游戏本身的信息以及静态与动态分析，为《时之笛》重建 C 源码库，可重新构建 Nintendo 64、GameCube 和 iQue Player 共 16 个 ROM 版本。素材取自使用者自备的 ROM，默认构建会以对应版本的 MD5 校验；README 说明项目不制作 PC 移植，并仍称仓库处于开发中。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"baocut-design-canvas-case","name":"BaoCut Design: porting reconstructed canvas and design-system editors","name_zh":"BaoCut Design：移植重建的设计稿与设计系统编辑器","url":"https://github.com/JimLiu/baocut/tree/7aa049e82e1367da013b7aba80f0b79033fa04ad/packages/design-runtime","evidence_url":"https://github.com/JimLiu/baocut/blob/7aa049e82e1367da013b7aba80f0b79033fa04ad/packages/design-runtime/README.md","description_en":"Documents BaoCut’s design-canvas and design-system editors, which the project says it ported 1:1 from TypeScript reconstructions of Claude Design’s editors and hosts in agent sessions with annotation and export. Its runtime notes record identifier fixes checked against the original scripts and a structural comparison matching 19,111 of 20,463 canvas main-page functions. Unreviewed differences, the unpublished reconstruction record and reuse rights remain open; no hosted-backend recovery is claimed.","description_zh":"记录 BaoCut 的设计稿（画布）与设计系统编辑器；项目称其按 1:1 移植自 Claude Design 编辑器的 TypeScript 重建，并在智能体会话中提供标注与导出。运行时说明记录了对照原脚本修正的标识符，以及画布主页面 20463 个函数中有 19111 个结构完全一致的比对结果。未审阅的差异、未公开的重建记录及复用权利仍待确认；不主张恢复任何托管后端。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","website"],"verified_at":"2026-10-18"},{"id":"project-arwing-star-fox-recomp-case","name":"Project Arwing: Star Fox recompiled from a matching disassembly","name_zh":"Project Arwing：由一致性反汇编重编译的 Star Fox","url":"https://github.com/carlosrmz009/arwing","evidence_url":"https://github.com/carlosrmz009/arwing/blob/d8fe7aaf67e0f4ba77c9814852d2ffaccd7d63c7/README.md","description_en":"Disassembles Star Fox’s 65816 and SuperFX code from runtime coverage and recursive descent, reassembles it into the original ROM, then translates it statically to C on a from-scratch SNES runtime for Windows, macOS and Linux. Code never reached in recorded sessions, and RAM code that no longer matches the ROM, falls back to an interpreter; the README reports identical per-frame hashes for both paths. The generated C is a mechanical translation rather than hand-decompiled source, and results remain project-reported.","description_zh":"依据运行覆盖率和递归下降反汇编 Star Fox 的 65816 与 SuperFX 代码，重新汇编出与原 ROM 一致的文件，再静态翻译为 C，运行于从零编写的 SNES 运行时，支持 Windows、macOS 和 Linux。录制会话中未执行到的代码，以及与 ROM 不再一致的 RAM 代码，回退到解释器执行；README 报告两条路径的逐帧哈希一致。生成的 C 是机械翻译而非手工反编译的源码，结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"project-arwing-2-star-fox-2-recomp-case","name":"Project Arwing (2): Star Fox 2 recompiled from a matching disassembly","name_zh":"Project Arwing (2)：由一致性反汇编重编译的 Star Fox 2","url":"https://github.com/carlosrmz009/arwing2","evidence_url":"https://github.com/carlosrmz009/arwing2/blob/15af0bfd85d00a79e8913094f7242e1b938f093f/README.md","description_en":"Rebuilds Star Fox 2 from a coverage-seeded 65816 and SuperFX disassembly that reassembles to the original ROM, then translates it statically to C for native Windows, macOS and Linux builds. Unreached code and RAM code that differs from the ROM run through an interpreter, and the README reports identical per-frame hashes against interpreted runs. It accepts the SNES Classic release image, not the 1995 prototypes; results remain project-reported.","description_zh":"从以运行覆盖率为种子的 65816 与 SuperFX 反汇编重建 Star Fox 2：反汇编可重新汇编为与原 ROM 一致的文件，再静态翻译为 C，生成原生 Windows、macOS 和 Linux 版本。未执行到的代码及与 ROM 不一致的 RAM 代码由解释器执行，README 报告其与解释运行的逐帧哈希一致。项目接受 SNES Classic 版映像，不支持 1995 年的原型版；结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"little-planet-sonic-cd-recomp-case","name":"Little Planet: Sonic CD recompiled from a matching disassembly","name_zh":"Little Planet：由一致性反汇编重编译的 Sonic CD","url":"https://github.com/carlosrmz009/littleplanet","evidence_url":"https://github.com/carlosrmz009/littleplanet/blob/658d834d53d90baf6a899fa1e5d81a6fee187bbb/README.md","description_en":"Disassembles every executable file on the Sonic CD disc from runtime coverage and recursive descent, reassembles them byte-identically, and translates the code statically to C on a from-scratch Mega-CD runtime that replaces the BIOS with a high-level implementation. Recompiled blocks run only where memory still holds the code they came from, and a script compares 96 stage runs frame by frame against the interpreter. The project also patches in widescreen and per-zone saves; results remain project-reported.","description_zh":"依据运行覆盖率和递归下降，反汇编 Sonic CD 光盘上的全部可执行文件并逐字节一致地重新汇编，再将代码静态翻译为 C，运行于从零编写、以高层实现替代 BIOS 的 Mega-CD 运行时。重编译代码块只在内存仍为其来源代码时执行，并有脚本以 96 段关卡运行逐帧对照解释器。项目还以补丁加入宽屏和逐区存档；结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"vf2-decomp-differential-recovery-case","name":"vf2-decomp: differentially validated Virtua Fighter 2 recovery","name_zh":"vf2-decomp：经差分验证的 Virtua Fighter 2 代码恢复","url":"https://github.com/celsowm/vf2-decomp","evidence_url":"https://github.com/celsowm/vf2-decomp/blob/9a9f7270f090cfa0f38b0ec6a22c3e53dae4bd18/README.md","description_en":"Recovers Virtua Fighter 2 Version 2.1’s Sega Model 2A i960 program into portable, non-matching C17, accepting each recovered path only when it matches a reference i960 executor at controlled boundaries. The repository adds ROM validation, i960 and 68000 analysis tools, a bounded Model 2A hardware model and snapshot-based differential runners. README states that it is not yet a playable port; match flow, combat, physics, AI, rasterization and much of the audio remain open.","description_zh":"将 Virtua Fighter 2 Version 2.1 的 Sega Model 2A i960 程序恢复为可移植、非一致性的 C17 代码，每条恢复路径须在受控边界上与参考 i960 执行器一致才被接受。仓库还提供 ROM 校验、i960 与 68000 分析工具、有限范围的 Model 2A 硬件模型，以及基于快照的差分运行器。README 说明它尚不是可游玩的移植；对战流程、格斗、物理、AI、光栅化及大部分音频仍未完成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"z2rs-zelda2-reconstruction-case","name":"z2rs: an incremental Rust reconstruction of Zelda II checked against an emulator","name_zh":"z2rs：以模拟器对照逐步重建《塞尔达传说 II》的 Rust 项目","url":"https://github.com/troyedwardsjr/z2rs","evidence_url":"https://github.com/troyedwardsjr/z2rs/blob/4fe7a35f8ccfdccdf32421badf97b48b02d0127f/README.md","description_en":"Rebuilds Zelda II: The Adventure of Link (NES) in Rust for desktop, browser and Android by replacing the game’s 6502 routines one at a time. A built-in interpreter still runs the user’s ROM and hands ported routines to Rust, while a verifier compares RAM, sprites, palette and frames with a reference emulator. It is a behavioral, clean-room-style reconstruction guided by a community disassembly, not a decompilation or a finished standalone engine.","description_zh":"以 Rust 重建 NES 游戏《塞尔达传说 II：林克的冒险》，逐个替换游戏的 6502 例程，可运行于桌面、浏览器和 Android。内置解释器仍执行使用者的 ROM，并把已移植例程交给 Rust 实现；验证工具将 RAM、精灵、调色板和画面与参考模拟器逐帧比较。它是参考社区反汇编、以行为为准的类净室重建，而不是反编译，也还不是独立完整的引擎。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"sm64ex-pc-port-case","name":"sm64ex: an enhanced Super Mario 64 PC port from the decompilation","name_zh":"sm64ex：基于反编译成果的 Super Mario 64 增强版 PC 移植","url":"https://github.com/sm64pc/sm64ex","evidence_url":"https://github.com/sm64pc/sm64ex/blob/d7ca2c04364a6dd0dac58b47151e04e26887e6f0/README.md","description_en":"Builds native Super Mario 64 executables from decompiled source, extending the sm64-port fork of the n64decomp reconstruction with renderer, input, camera, save-format and external-data options. Game assets are extracted from the user’s own ROM at build time. It is a non-matching enhanced port, not a byte-identical ROM reconstruction.","description_zh":"基于反编译源码构建原生 Super Mario 64 可执行文件，在 n64decomp 重建成果的 sm64-port 分支之上，增加渲染器、输入、视角、存档格式和外部数据等选项。游戏素材在构建时从使用者自备的 ROM 中提取。这是非一致性的增强移植，而不是逐字节一致的 ROM 重建。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ghostship-sm64-port-case","name":"Ghostship: a libultraship native port of Super Mario 64","name_zh":"Ghostship：基于 libultraship 的 Super Mario 64 原生移植","url":"https://github.com/HarbourMasters/Ghostship","evidence_url":"https://github.com/HarbourMasters/Ghostship/blob/40eef13823a954a466574dc78e73187a17a2dd42/README.md","description_en":"Builds Super Mario 64 as a native PC, Switch and Android program by compiling decompilation-style game source against the libultraship platform library. A bundled extractor converts the user’s US or Japanese ROM into an O2R archive at first launch or build time. The project ships modern renderers, configuration menus and mod-archive loading, not a matching ROM.","description_zh":"将反编译风格的游戏源码编译到 libultraship 平台库上，把 Super Mario 64 构建为原生 PC、Switch 和 Android 程序。附带的提取工具会在首次启动或构建时，把使用者自备的美版或日版 ROM 转换为 O2R 存档。项目提供现代渲染器、配置菜单和模组存档加载，而不是生成一致的 ROM。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"sms-matching-decomp-case","name":"Super Mario Sunshine: an in-progress matching GameCube decompilation","name_zh":"Super Mario Sunshine：仍在推进的 GameCube 一致性反编译重建","url":"https://github.com/doldecomp/sms","evidence_url":"https://github.com/doldecomp/sms/blob/b2350a119b0e113e6cebc389fda9af00328ee85e/README.md","description_en":"Reconstructs Super Mario Sunshine’s C++ source so that the original Metrowerks compiler reproduces byte-identical object files for four GameCube releases and the Switch 3D All-Stars build. The target binary comes from the user’s own disc image, and objdiff compares rebuilt objects function by function. The work is incomplete, and the repository publishes contribution rules for AI agents alongside its human workflow.","description_zh":"重建 Super Mario Sunshine 的 C++ 源码，目标是让原版 Metrowerks 编译器为四个 GameCube 发行版本及 Switch 版 3D All-Stars 生成逐字节一致的目标文件。目标二进制取自使用者自备的光盘镜像，objdiff 按函数比对重建出的目标文件。工作尚未完成，仓库在人工流程之外还发布了面向 AI 智能体的贡献规则。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"dusklight-twilight-princess-port-case","name":"Dusklight: a native Twilight Princess port built on the decompilation","name_zh":"Dusklight：基于反编译的《黄昏公主》原生移植","url":"https://github.com/TwilitRealm/dusklight","evidence_url":"https://github.com/TwilitRealm/dusklight/blob/34a144a493b7f57adeb4034d382317c826eb5c8d/README.md","description_en":"Reimplements Twilight Princess as a native application for desktop and mobile platforms, building on the zeldaret/tp decompilation and the Aurora GameCube/Wii compatibility layer. It runs from the user’s own disc image with no bundled assets and aims to stay accurate to the original while adding options, enhancements and mods.","description_zh":"以 zeldaret/tp 反编译项目和 Aurora GameCube／Wii 兼容层为基础，将《塞尔达传说 黄昏公主》重新实现为桌面与移动平台的原生应用。程序读取使用者自备的光盘镜像运行，不附带任何素材；项目力求忠于原作，同时加入新选项、增强功能和模组。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"metaforce-metroid-prime-case","name":"Metaforce: a Metroid Prime engine reimplementation rebuilt on the decompilation","name_zh":"Metaforce：在反编译之上重建的《密特罗德 Prime》引擎重实现","url":"https://github.com/AxioDL/metaforce","evidence_url":"https://github.com/AxioDL/metaforce/blob/de8fc69bd7f345d6cf5f0c8fc2798295e22522d3/README.md","description_en":"Started in 2015 as a reverse-engineered reimplementation of the Metroid Prime engine, Metaforce has been rewritten on top of the PrimeDecomp matching decompilation. Its native app compiles that game code as non-matching C++ for desktop and mobile through the Aurora GameCube compatibility layer and loads a user-selected disc image. The README says builds are unavailable while the rewrite stabilizes.","description_zh":"Metaforce 于 2015 年作为《密特罗德 Prime》引擎的逆向重实现项目启动，现已在 PrimeDecomp 一致性反编译之上重写。其原生应用借助 Aurora GameCube 兼容层，将这些游戏代码以非一致模式编译为桌面和移动端程序，并读取使用者选择的光盘镜像。README 表示重写稳定之前暂不提供构建版本。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"sms-english-gmse01-decomp-case","name":"Super Mario Sunshine (USA): an AI-assisted matching decompilation fork","name_zh":"Super Mario Sunshine（美版）：AI 辅助的一致性反编译分支","url":"https://github.com/chasem-dev/sms-english","evidence_url":"https://github.com/chasem-dev/sms-english/blob/d5f4eb3eb54ac49638b5513efb1fc368068805da/README.md","description_en":"Extends the doldecomp Super Mario Sunshine decompilation to the North American GMSE01 release. The README says AI was used extensively, and the repository’s agent rules, work order and progress files describe batch-based Claude and Codex orchestration. Its rebuilt DOL is reported byte-identical, but unfinished objects are still linked from code extracted from the user’s disc.","description_zh":"将 doldecomp 的 Super Mario Sunshine 反编译工作扩展到北美 GMSE01 版本。README 称大量使用了 AI，仓库中的智能体规则、工作顺序和进度文件也记录了按批次编排 Claude 与 Codex 的方式。项目报告重建的 DOL 逐字节一致，但尚未完成的目标文件仍取自使用者光盘中提取的代码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"dk64-recompiled-case","name":"Donkey Kong 64: Recompiled — an N64Recomp native port","name_zh":"Donkey Kong 64: Recompiled：基于 N64Recomp 的原生移植","url":"https://github.com/Rainchus/Donkey-Kong-64-Recompiled","evidence_url":"https://github.com/Rainchus/Donkey-Kong-64-Recompiled/blob/3b0c36d3fbfeb0b5d2c47923f35cf84b31edcbf7/README.md","description_en":"Uses N64Recomp to statically recompile the US Nintendo 64 release of Donkey Kong 64 into a native port, with RT64 as the renderer. The port is not built from decompiled source, but borrows headers and some functions from the in-progress DK64 decompilation for patches and enhancements. Its recompiler configuration reads a checked-in symbol dump and the ROM rather than a decompilation ELF.","description_zh":"使用 N64Recomp 将美版 Nintendo 64《大金刚 64》静态重编译为原生移植版，并以 RT64 作为渲染器。该移植并非基于反编译源码构建，但借用仍在进行中的 DK64 反编译项目的头文件和部分函数来实现补丁与增强。其重编译配置读取仓库内的符号转储和 ROM，而非反编译生成的 ELF。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"twilight-princess-decomp-case","name":"Twilight Princess: a decompilation with fully matching GameCube code","name_zh":"《黄昏公主》：GameCube 版代码完全一致的反编译","url":"https://github.com/zeldaret/tp","evidence_url":"https://github.com/zeldaret/tp/blob/c8fa8c9e2aab72cf4e5db0e5d1c84a9ea6ee6eb0/README.md","description_en":"Reconstructs Twilight Princess source that compiles back to binaries identical to the originals, building GameCube, Wii and Nvidia Shield releases from one codebase through conditional compilation. README reports the GameCube code as completely matching but not every translation unit linked yet, with Debug and Wii alignment ongoing; the repository ships no assets or assembly and will not produce a port.","description_zh":"重建《塞尔达传说 黄昏公主》的源码，使其能重新编译出与原版一致的二进制文件；GameCube、Wii 与 Nvidia Shield 各版本通过条件编译共用同一套代码。README 报告 GameCube 版代码已完全一致，但尚未链接全部翻译单元，调试版与 Wii 版的对齐仍在进行；仓库不含素材或汇编，也不会制作移植。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"sotn-matching-decomp-case","name":"Castlevania: Symphony of the Night: matching decompilation across PlayStation, PSP and Saturn builds","name_zh":"Castlevania: Symphony of the Night：覆盖 PlayStation、PSP 与 Saturn 版本的一致性反编译","url":"https://github.com/Xeeynamo/sotn-decomp","evidence_url":"https://github.com/Xeeynamo/sotn-decomp/blob/eddaf22fe86f5189b85fd34915afe6564f19df20/README.md","description_en":"Recreates C source for Castlevania: Symphony of the Night from its PlayStation, PSP and Saturn binaries, aiming for code that compiles byte for byte to the original game files. The work-in-progress build combines decompiled code with assets and assembly extracted from a user-supplied disc image, then checks per-version SHA-1 hashes. Native PC experiments in the same tree are documented as unfinished and are not a released port.","description_zh":"从《恶魔城 月下夜想曲》的 PlayStation、PSP 和 Saturn 版二进制重建 C 源码，目标是逐字节编译出与原游戏文件一致的产物。这一进行中的构建将已反编译代码与从使用者自备光盘镜像提取的素材和汇编结合，再按版本检查 SHA-1 哈希。同一仓库中的原生 PC 实验被文档说明为尚未完成，并不是已发布的移植。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"lego-island-portable-case","name":"LEGO Island, portable: a multi-platform port of the decompiled source","name_zh":"LEGO Island 可移植版：反编译源码的多平台移植","url":"https://github.com/isledecomp/isle-portable","evidence_url":"https://github.com/isledecomp/isle-portable/blob/d0bf04fe605d7ec2a291e65df08bf26712452379/README.md","description_en":"Adapts the LEGO Island decompilation into a portable build for desktop, mobile, console, DOS and Web targets. Windows-only subsystems are replaced with SDL3, miniaudio, iniparser and a custom Direct3D Retained Mode re-implementation, while core gameplay is meant to stay unchanged. It ports reconstructed source rather than checking byte-identical binaries, so it is distinct from the exact-rebuild decompilation case.","description_zh":"将 LEGO Island 反编译源码改造为可在桌面、移动设备、游戏主机、DOS 及 Web 上构建的移植版本。项目以 SDL3、miniaudio、iniparser 和自行重新实现的 Direct3D Retained Mode 替代仅限 Windows 的子系统，并力求保持核心玩法不变。它移植的是重建源码，而不校验与原版逐字节一致的二进制文件，因此有别于精确重构建的反编译案例。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"crash-bandicoot-c1-port-case","name":"c1: a C port of PlayStation Crash Bandicoot","name_zh":"c1：PlayStation 版《古惑狼》的 C 语言移植","url":"https://github.com/wurlyfox/c1","evidence_url":"https://github.com/wurlyfox/c1/blob/256fdcef59f15a190290cc19db3fa9a707843b69/README.md","description_en":"Ports the original PlayStation Crash Bandicoot game code to C function by function; its coding standard labels functions with the addresses of their original implementations. Only the PC build, using OpenGL, SDL2 and FluidSynth, currently works; it loads asset files from the user’s game disc and is only partially playable.","description_zh":"将 PlayStation 版《古惑狼》的原始游戏代码逐函数移植为 C 语言；其编码规范要求为函数标注原实现的地址。目前只有基于 OpenGL、SDL2 和 FluidSynth 的 PC 构建可用；它读取用户自备游戏光盘中的素材文件，仅能部分游玩。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"metroid-prime-port-case","name":"Metroid Prime Port: an AI-assisted native port of the PrimeDecomp decompilation","name_zh":"Metroid Prime Port：AI 辅助完成的 PrimeDecomp 反编译原生移植","url":"https://github.com/Odrannnn/MetroidPrimePort","evidence_url":"https://github.com/Odrannnn/MetroidPrimePort/blob/26febe4e09685ab68e7e0a9822934c0daa306a22/README.md","description_en":"Compiles the PrimeDecomp decompilation of Metroid Prime’s game and engine code as native C++20 for Linux, Windows and Android, with an experimental macOS build. Aurora supplies the GameCube SDK compatibility layer and rendering, and the port reads a user-supplied disc image at run time. The author states that parts were written with AI coding assistants under their oversight.","description_zh":"将 PrimeDecomp 对《密特罗德 Prime》游戏与引擎代码的反编译结果编译为原生 C++20 程序，支持 Linux、Windows 和 Android，另有实验性 macOS 版本。Aurora 提供 GameCube SDK 兼容层和渲染，移植版在运行时读取使用者自备的光盘镜像。作者声明部分代码是在其监督下借助 AI 编程助手编写的。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"wind-waker-decomp-case","name":"The Wind Waker: a GameCube decompilation with hash-checked relinking","name_zh":"《风之杖》：以哈希校验重新链接的 GameCube 版反编译","url":"https://github.com/zeldaret/tww","evidence_url":"https://github.com/zeldaret/tww/blob/8b93b372dc8e841f12ddfb7e0215626f62b05417/README.md","description_en":"Reconstructs source for The Wind Waker’s GameCube executable and REL modules across the USA/Korea, PAL and Japanese releases and a Japanese kiosk demo. Matched units are compiled from source and linked with objects split from the user’s disc, then checked against per-version SHA-1 hashes; the repository ships no assets or assembly and covers the GameCube game, not the HD remaster.","description_zh":"为《塞尔达传说 风之杖》GameCube 版的可执行文件和 REL 模块重建源码，涵盖美版／韩版、PAL 版、日版及日本体验版。已匹配的单元由源码编译，再与从使用者光盘中拆分出的对象链接，并按各版本的 SHA-1 哈希校验；仓库不含素材或汇编，范围是 GameCube 版而非 HD 重制版。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"sonic-mania-decomp-case","name":"Sonic Mania: a game-code decompilation for the RSDKv5 engine","name_zh":"Sonic Mania：面向 RSDKv5 引擎的游戏代码反编译重建","url":"https://github.com/RSDKModding/Sonic-Mania-Decompilation","evidence_url":"https://github.com/RSDKModding/Sonic-Mania-Decompilation/blob/9dc699428420d752af9767bdb13f585ee0881bc0/README.md","description_en":"Reconstructs Sonic Mania’s game code in C and builds it with the separately decompiled RSDKv5 or RSDKv5U engine for Windows, Linux, Switch and Android. Assets must come from an official Sonic Mania (Plus) release; the project adds a mod loader and can build several retail versions. Its license describes the code as mostly functionally the same as the original, not byte-matching.","description_zh":"以 C 重建《索尼克狂欢》的游戏代码，并与另行反编译的 RSDKv5 或 RSDKv5U 引擎一起构建，支持 Windows、Linux、Switch 和 Android。素材必须来自官方发行的 Sonic Mania (Plus)；项目加入了模组加载器，并可构建多个零售版本。其许可证称代码大多在功能上与原作相同，而不是逐字节一致。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"medievil-recomp-case","name":"MediEvil Recomp: a PlayStation static recompilation to C#","name_zh":"MediEvil Recomp：PlayStation 游戏静态重编译为 C#","url":"https://github.com/BlackLabelHQ/MediEvilRecomp","evidence_url":"https://github.com/BlackLabelHQ/MediEvilRecomp/blob/b9e46db34db40d6e5c8e19b538e4d517299a4012/README.md","description_en":"Statically recompiles the North American PlayStation release of MediEvil into C# with the RecompOne recompiler and runtime. The runtime stands in for BIOS, GPU, CD-ROM and other hardware services, and project patches change rendering, widescreen and terrain behavior. README stresses that this is a recompilation, not a decompilation, and labels it an open beta.","description_zh":"使用 RecompOne 重编译器及运行时，将北美版 PlayStation《MediEvil》静态重编译为 C# 代码。运行时代为提供 BIOS、GPU、CD-ROM 等硬件服务，项目补丁则修改渲染、宽屏和地形表现。README 强调这是重编译而非反编译，并将其标为公开测试版。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"crash2recomp-case","name":"Crash Bandicoot 2 Recompiled: a PSXRecomp native build","name_zh":"Crash Bandicoot 2 Recompiled：基于 PSXRecomp 的原生构建","url":"https://github.com/Zumbo06/Crash2Recomp","evidence_url":"https://github.com/Zumbo06/Crash2Recomp/blob/48036cf3b49dfe4343e5c093d1df8a7b12617f81/README.md","description_en":"A Windows launcher that uses the PSXRecomp recompiler and runtime to translate the user’s Crash Bandicoot 2: Cortex Strikes Back disc to C and compile it locally, so the game runs as native code with an emulated PlayStation hardware layer. The repository holds the launcher, a patched vendored runtime and a long bring-up log; it distributes no game code or data.","description_zh":"一个 Windows 启动器，借助 PSXRecomp 重编译器与运行时，将用户自备的《古惑狼 2》光盘转换为 C 代码并在本地编译，使游戏以原生代码配合模拟的 PlayStation 硬件层运行。仓库包含启动器、打过补丁的内置运行时以及详细的调试记录，不分发任何游戏代码或数据。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"petari-smg-decomp-case","name":"Petari: a matching Super Mario Galaxy decompilation","name_zh":"Petari：Super Mario Galaxy 一致性反编译重建","url":"https://github.com/SMGCommunity/Petari","evidence_url":"https://github.com/SMGCommunity/Petari/blob/86ae7a3d3241adf07d5d3f9949e0462cccc583c1/README.md","description_en":"Reconstructs Super Mario Galaxy’s Wii code as C++ that rebuilds, object by object, against main.dol files extracted from the user’s own Japanese, North American, PAL or Korean disc. Matched objects are linked from source and checked with objdiff and a target hash. The project describes itself as a work in progress, separate from any PC port, and says it does not accept AI-generated decompilation.","description_zh":"将 Super Mario Galaxy 的 Wii 代码重建为 C++，并以使用者从自有日版、北美版、PAL 版或韩版光盘中提取的 main.dol 为目标，逐个目标文件重建。已匹配的目标文件由源码链接，并通过 objdiff 和目标哈希检查。项目自称仍在进行中，与任何 PC 移植无关，并表示不接受 AI 生成的反编译代码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"wind-waker-hd-recomp-case","name":"Wind Waker HD Recomp: a native port by static recompilation of the Wii U game","name_zh":"Wind Waker HD Recomp：通过静态重编译实现的 Wii U 游戏原生移植","url":"https://github.com/ZeldaWWHDRecomp/ZeldaWWHDRecomp","evidence_url":"https://github.com/ZeldaWWHDRecomp/ZeldaWWHDRecomp/blob/f10b56621ed13e0053e7cf8190e740834377e45a/README.md","description_en":"Statically recompiles The Wind Waker HD’s Wii U PowerPC code to C ahead of time, reimplements the Cafe OS libraries the game uses and implements GX2 graphics on Metal or Vulkan, producing native macOS, Linux, Windows and Android builds without a Cemu runtime. All game code and data are generated locally from the user’s own dump; an experimental macOS-only build can instead run functions from the separate ZeldaWWHDDecomp/wwhd decompilation.","description_zh":"将《塞尔达传说 风之杖 HD》Wii U 版的 PowerPC 代码预先静态重编译为 C，原生重新实现游戏所用的 Cafe OS 库，并在 Metal 或 Vulkan 上实现 GX2 图形，生成无需 Cemu 运行时的 macOS、Linux、Windows 和 Android 原生版本。所有游戏代码和数据都由使用者自己的转储在本地生成；另有仅限 macOS 的实验性构建，可改为运行独立的 ZeldaWWHDDecomp/wwhd 反编译中的函数。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"cv64-recompiled-case","name":"Castlevania 64: Recompiled — a beta static-recompilation port","name_zh":"Castlevania 64: Recompiled：测试版静态重编译移植","url":"https://github.com/RevoSucks/CV64Recomp","evidence_url":"https://github.com/RevoSucks/CV64Recomp/blob/141b35d8902a6c74e247988df26d394822f8026c/flatpak/io.github.cv64recomp.cv64recomp.metainfo.xml","description_en":"Uses N64Recomp to statically recompile the US 1.0 Nintendo 64 release of Castlevania into a native PC port rendered with RT64. Game-specific C patches build against headers from a separate Castlevania 64 decompilation. A beta release tagged at the reviewed commit reports a working build with known issues, while the README there still describes an unfinished project.","description_zh":"使用 N64Recomp 将 Nintendo 64 版 Castlevania 美版 1.0 静态重编译为原生 PC 移植，并以 RT64 渲染。游戏专用的 C 补丁基于另一个 Castlevania 64 反编译项目的头文件构建。在所审提交上标记的测试版发布报告构建可用并列出已知问题，而同一提交的 README 仍称项目尚未完成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"rsdkv5-engine-decomp-case","name":"RSDKv5 Decompilation: reconstructing Retro Engine v5 and v5U","name_zh":"RSDKv5 Decompilation：重建 Retro Engine v5 与 v5U","url":"https://github.com/RSDKModding/RSDKv5-Decompilation","evidence_url":"https://github.com/RSDKModding/RSDKv5-Decompilation/blob/191d7aea6c262d891244172a8609ac69fbfd7571/README.md","description_en":"Reconstructs the Retro Engine (RSDK) v5 and v5 Ultimate runtime, the engine that runs Sonic Mania’s game code, and builds it for Windows, Linux, Switch and Android. RSDKv5U can also run RSDKv3 and RSDKv4 games such as Sonic CD and Sonic 1 & 2. The project adds a mod loader, a shader compiler and extra Windows backends, and ships no game data.","description_zh":"重建 Retro Engine（RSDK）v5 及 v5 Ultimate 运行时，即运行《索尼克狂欢》游戏代码的引擎，可构建 Windows、Linux、Switch 和 Android 版本。RSDKv5U 还能运行 RSDKv3 与 RSDKv4 游戏，例如 Sonic CD 和 Sonic 1 & 2。项目增加了模组加载器、着色器编译器和额外的 Windows 后端，且不附带任何游戏数据。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"c2c-crash2-hybrid-recompilation-case","name":"C2C: hybrid recompilation and hand decompilation of Crash Bandicoot 2","name_zh":"C2C：《古惑狼 2》的混合重编译与手工反编译","url":"https://github.com/ughman/c2c","evidence_url":"https://github.com/ughman/c2c/blob/2e9535fb0c59e37bf42316cb768be80c5e8073d4/README.md","description_en":"An early reverse-engineering effort on PlayStation Crash Bandicoot 2 that converts the engine’s MIPS machine code directly into a very large C file and runs it against a modified PCSX-R emulator library for hardware I/O. Translated functions are meant to be decompiled by hand and moved into ordinary C, gradually replacing the mechanical translation.","description_zh":"一个早期的 PlayStation《古惑狼 2》逆向工程项目：把引擎的 MIPS 机器码直接转换为一个体量巨大的 C 文件，并调用改造后的 PCSX-R 模拟器库处理硬件 I/O。转换出的函数计划逐个手工反编译为普通 C 代码，逐步替换机械转换的部分。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"medievil-decomp-case","name":"MediEvil decompilation: an early checksum-gated PlayStation project","name_zh":"MediEvil 反编译：早期阶段、以校验值把关的 PlayStation 项目","url":"https://github.com/MediEvilDecompilation/medievil-decomp","evidence_url":"https://github.com/MediEvilDecompilation/medievil-decomp/blob/6afe6fe35d5ddf0ce1bebdb2e72f8215b5b5b407/README.md","description_en":"Decompiles the US PlayStation release of MediEvil toward C source that rebuilds its main executable, game executable and 26 overlays. splat splits the user's own disc files, and the default build compares all 28 outputs with SHA-1 checksums. README describes the project as a work in progress and publishes no progress figure.","description_zh":"将美版 PlayStation《MediEvil》逐步反编译为 C 源码，目标是重新生成其主程序、游戏程序及 26 个覆盖模块。splat 拆分使用者自备的光盘文件，默认构建会将全部 28 个产物与 SHA-1 校验值比较。README 称项目仍在进行中，未公布进度数据。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"cbfd-recompiled-case","name":"Conker's Bad Fur Day: Recompiled — an N64Recomp native port","name_zh":"Conker's Bad Fur Day: Recompiled：基于 N64Recomp 的原生移植","url":"https://github.com/sciaschi/CBFD-Recompiled","evidence_url":"https://github.com/sciaschi/CBFD-Recompiled/blob/ed1b8bb7f3f036334124ec27eb28efa64e400178/README.md","description_en":"Statically recompiles the US Nintendo 64 release of Conker’s Bad Fur Day with N64Recomp into a native Windows, Linux and macOS port on N64ModernRuntime and RT64. Function names and boundaries come from a vendored, still mostly assembly decompilation, while the recompiled code is taken from the user’s ROM so unmatched decompiled C cannot change behavior. The author reports heavy use of Claude Code across the project.","description_zh":"使用 N64Recomp 将美版 Nintendo 64《Conker's Bad Fur Day》静态重编译为基于 N64ModernRuntime 和 RT64 的原生 Windows、Linux 与 macOS 移植版。函数名称与边界来自仓库内置、仍以汇编为主的反编译项目，而重编译的代码取自用户的 ROM，因此尚未匹配的反编译 C 代码不会改变游戏行为。作者称整个项目大量使用了 Claude Code。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"projectcane-sly1-pc-port-case","name":"ProjectCane: a native PC port of Sly Cooper and the Thievius Raccoonus","name_zh":"ProjectCane：《Sly Cooper and the Thievius Raccoonus》原生 PC 移植","url":"https://github.com/theclub654/ProjectCane","evidence_url":"https://github.com/theclub654/ProjectCane/blob/d8e34caf5edd2a0e2d4ec292b69145425ec6201c/README.md","description_en":"Rebuilds the NTSC PlayStation 2 release of Sly Cooper and the Thievius Raccoonus as a native C++ game for Windows and Linux, running on data extracted from the player's own disc image. The README reports the full game as playable while work continues on accuracy and remaining differences from the original. It does not describe its reverse-engineering method or relate the port to the separate sly1 decompilation.","description_zh":"将 PlayStation 2 版《Sly Cooper and the Thievius Raccoonus》美版重建为 Windows 和 Linux 上的原生 C++ 游戏，运行时使用从玩家自有光盘镜像中提取的数据。README 报告整部游戏均可游玩，同时仍在改进准确性并处理与原版的剩余差异。项目未说明其逆向工程方法，也未说明与另一个 sly1 反编译项目的关系。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"firefighter-rust-port-case","name":"Firefighter: a decompiled DOS game ported to Rust","name_zh":"Firefighter：将反编译的 DOS 游戏移植为 Rust","url":"https://gitlab.com/esr/firefighter","evidence_url":"https://gitlab.com/esr/firefighter/-/blob/84861db110928202571af2042cb9762720dc2c3e/history.adoc","description_en":"Eric S. Raymond’s terminal port of Firefighter, Eben Sprinsock’s 1985 DOS shareware game. The project history says ChatGPT 5.5 decompiled the DOS binary to Borland Pascal and translated it to Rust, after which Raymond modernized the interface and corrected a scoring mismatch. Unchanged gameplay is the author’s statement; the intermediate Pascal and any comparison runs are not published.","description_zh":"Eric S. Raymond 将 Eben Sprinsock 于 1985 年发布的 DOS 共享软件游戏 Firefighter 移植为终端游戏。项目历史记载，ChatGPT 5.5 先将 DOS 二进制反编译为 Borland Pascal，再译为 Rust；之后 Raymond 改进了界面，并修正一处计分不符。玩法未变是作者的说法；中间 Pascal 代码及任何对照运行均未公开。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"flipper-telink-tuya-remote-firmware-case","name":"flipper-telink: replacement firmware for Tuya Zigbee remotes","name_zh":"flipper-telink：Tuya Zigbee 遥控器的替换固件","url":"https://github.com/ngxson/flipper-telink","evidence_url":"https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/ss6400zb/README.md","description_en":"A Flipper Zero app that bit-bangs Telink’s SWire debug interface to dump and reflash TLSR825x Zigbee devices, with static-analysis notes on the dumps and freshly written firmware for two of them. For Tuya TS0044/TS0046 scene remotes, the notes trace the stock ~500 ms single-click delay to a double-click window; the replacement firmware drops that window while presenting the stock model IDs to Zigbee2MQTT. The latest Zigbee build is marked unverified for pairing, actions and battery reporting.","description_zh":"一款 Flipper Zero 应用，以位操作驱动 Telink 的 SWire 调试接口，用于转储并重刷 TLSR825x Zigbee 设备；仓库还附有对转储固件的静态分析笔记，以及为其中两款设备全新编写的固件。针对 Tuya TS0044/TS0046 场景遥控器，笔记将原厂约 500 ms 的单击延迟追溯到双击判定窗口；替换固件取消该窗口，同时向 Zigbee2MQTT 呈现原厂型号标识。最新 Zigbee 版本的配对、动作及电量上报被标注为尚未验证。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-10-18"},{"id":"khdays-native-pc-port-case","name":"Kingdom Hearts 358/2 Days: native PC port built on a matching decompilation","name_zh":"Kingdom Hearts 358/2 Days：基于一致性反编译的原生 PC 移植","url":"https://github.com/Yokimitsuro/khdays-port","evidence_url":"https://github.com/Yokimitsuro/khdays-port/blob/8e0ad0b04d97d869c53f301bc40987f0ab929799/README.md","description_en":"Compiles the C of the khdays-decomp matching decompilation for Windows x64 and supplies a native platform layer for the Nintendo DS hardware, SDK services and sound driver. README reports the whole game running without an ARM interpreter; its rendering, controls, mod support and network multiplayer are the port’s own additions. This is a decompilation-based port, distinct from the byte-matching DS reconstruction it builds on.","description_zh":"将 khdays-decomp 一致性反编译的 C 代码编译为 Windows x64 程序，并以原生平台层替代 Nintendo DS 硬件、SDK 服务及声音驱动。README 报告整款游戏无需 ARM 解释器即可运行；渲染、操作、模组支持与网络联机均为移植自身新增。这是基于反编译的移植，与其所依托的逐字节一致 DS 重建并非同一产物。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ico-pc-port-case","name":"ico-pc: a native ICO port compiled from the PS2 decompilation","name_zh":"ico-pc：由 PS2 反编译源码编译而成的《ICO》原生移植","url":"https://github.com/nathanialf/ico-pc","evidence_url":"https://github.com/nathanialf/ico-pc/blob/4c29ac4c121a357092dea6ee12f6d715ce6cf1f9/README.md","description_en":"Compiles the decompiled C of the PlayStation 2 game ICO natively for Windows, Linux, Android, iPhone and Apple-silicon Macs, with host code standing in for the PS2 hardware and Sony libraries. No PS2 code is interpreted or recompiled, and the program reads the player's PAL disc image on first start. It is a native port of a separately byte-matched decompilation, with documented divergences and optional enhancements.","description_zh":"将 PlayStation 2 游戏《ICO》的反编译 C 源码原生编译到 Windows、Linux、Android、iPhone 及 Apple 芯片 Mac 上，并以宿主代码替代 PS2 硬件和 Sony 函数库。项目不解释执行或重编译任何 PS2 代码，程序在首次启动时读取玩家自备的 PAL 光盘镜像。它是另一个逐字节匹配的反编译项目的原生移植，记录了与原版的差异，并提供可选增强功能。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"sly1-matching-decomp-case","name":"Sly Cooper and the Thievius Raccoonus: matching PlayStation 2 decompilation","name_zh":"Sly Cooper and the Thievius Raccoonus：PlayStation 2 一致性反编译","url":"https://github.com/TheOnlyZac/sly1","evidence_url":"https://github.com/TheOnlyZac/sly1/blob/ea5e2d77ac2a083df1efeafcee178f895943b13d/README.md","description_en":"Reconstructs source code for SCUS_971.98, the NTSC-U PlayStation 2 executable of Sly Cooper and the Thievius Raccoonus, as a work-in-progress matching decompilation. Functions not yet matched are still assembled from code split out of the user's own executable, and the build checks the linked ELF's SHA-1. The result runs in PCSX2 with the original disc for assets; it is not a native PC port.","description_zh":"将《Sly Cooper and the Thievius Raccoonus》PlayStation 2 美版可执行文件 SCUS_971.98 重建为源码，属于进行中的一致性反编译。尚未匹配的函数仍由从使用者自备可执行文件中拆分出的汇编构建，构建会检查链接后 ELF 的 SHA-1。产物需在 PCSX2 中配合原版光盘素材运行，并不是原生 PC 移植。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokemon-emerald-decomp-case","name":"Pokémon Emerald: a matching Game Boy Advance decompilation","name_zh":"《宝可梦 绿宝石》：生成一致 ROM 的 Game Boy Advance 反编译重建","url":"https://github.com/pret/pokeemerald","evidence_url":"https://github.com/pret/pokeemerald/blob/731ad5bfd6e6f265508d0efcca0ba42f9dcf5881/README.md","description_en":"Reconstructs Pokémon Emerald for the Game Boy Advance as buildable C source, with game scripts and data kept as assembler directives. The default agbcc build produces pokeemerald.gba, and make compare checks it against the SHA-1 of the original English ROM; an optional modern-GCC build is not hash-checked. Graphics and audio sources are committed in the tree, so the documented build reads no base ROM.","description_zh":"为 Game Boy Advance 版《宝可梦 绿宝石》重建可构建的 C 源码，游戏脚本和数据以汇编指令形式保存。默认的 agbcc 构建生成 pokeemerald.gba，make compare 将其与英文原版 ROM 的 SHA-1 比对；可选的现代 GCC 构建不做哈希校验。图像和音频源文件已提交在仓库中，因此文档所述的构建流程不读取原 ROM。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"paper-mario-matching-decomp-case","name":"Paper Mario: matching Nintendo 64 decompilation for four releases","name_zh":"Paper Mario：覆盖四个版本的一致性 Nintendo 64 反编译","url":"https://github.com/pmret/papermario","evidence_url":"https://github.com/pmret/papermario/blob/1104f1f71b824042a5fa1f958f2d861b603320fd/README.md","description_en":"Reconstructs Paper Mario’s Nintendo 64 code as C source that rebuilds the US, Japanese, PAL and iQue ROMs. The build takes assets and comparison inputs from a user-supplied original ROM, then checks each output against a recorded SHA-1. Mutable project reports list no remaining nonmatching functions, while the README still calls the decompilation work in progress; it is distinct from the PaperBoat native port.","description_zh":"将 Paper Mario 的 Nintendo 64 代码重建为 C 源码，可重新构建美版、日版、PAL 版和 iQue 版 ROM。构建流程从使用者自备的原 ROM 取得素材和比较输入，再将每个产物与记录的 SHA-1 比对。项目可变的进度报告显示已无未匹配函数，但 README 仍称反编译在进行中；该项目与 PaperBoat 原生移植不同。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"tenkaichi3-pc-port-case","name":"Budokai Tenkaichi 3: a native PC port built on a matching decompilation","name_zh":"Budokai Tenkaichi 3：基于一致性反编译的原生 PC 移植","url":"https://github.com/z3xox/Tenkaichi3Decomp","evidence_url":"https://github.com/z3xox/Tenkaichi3Decomp/blob/ec3c85a98cffd9cd22c22ac14cd62fb584d23664/README.md","description_en":"Compiles the decompiled code of Dragon Ball Z: Budokai Tenkaichi 3 (PS2, USA release SLUS-21678) for PC on a new renderer, sound, input and platform layer rather than an emulator. The game code comes from the separate BT3-Decompiled matching decompilation, and the game's data is read from the user's own disc image. The README reports the full game loop and experimental online play and says AI helped make the project; these results remain project-reported.","description_zh":"将 Dragon Ball Z: Budokai Tenkaichi 3（PS2 美版 SLUS-21678）的反编译代码编译到 PC，运行在新的渲染、音频、输入和平台层上，而非借助模拟器。游戏代码来自独立的 BT3-Decompiled 一致性反编译项目，游戏数据从使用者自备的光盘镜像读取。README 报告完整游戏流程可运行、联网对战处于实验阶段，并称项目借助 AI 完成；这些结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"d2r-mobile-switch-rehost-case","name":"D2R Mobile: rehosting Diablo II: Resurrected’s Switch program on Apple devices","name_zh":"D2R Mobile：在 Apple 设备上重新托管 Diablo II: Resurrected 的 Switch 程序","url":"https://github.com/jhaizhou-ops/d2r-mobile","evidence_url":"https://github.com/jhaizhou-ops/d2r-mobile/blob/9393b00ea9aca52d9254214da93738f26582562f/README.md","description_en":"Runs the Nintendo Switch release’s own aarch64 program natively on iPhone, iPad and Apple silicon Macs, rewriting only instructions that depend on the Horizon kernel and supplying its system services and the NVN graphics API on Metal. Shaders are translated offline from the user’s files, and the project adds its own touch interface and endgame features. It is a rehosting compatibility layer, not a decompilation or recompiled source.","description_zh":"在 iPhone、iPad 和 Apple 芯片 Mac 上原生运行 Nintendo Switch 版自身的 aarch64 程序，仅改写依赖 Horizon 内核的指令，并以 Metal 提供其系统服务与 NVN 图形 API。着色器由使用者自有文件离线转译，项目另行加入触控界面与终局玩法。这是重新托管的兼容层，不是反编译或重编译出的源码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"rac1-matching-decomp-case","name":"Ratchet & Clank: a matching PS2 decompilation with a documented agent workflow","name_zh":"Ratchet & Clank：记录了代理流程的 PS2 一致性反编译","url":"https://github.com/OpenRAC/rac1-decomp","evidence_url":"https://github.com/OpenRAC/rac1-decomp/blob/7f5d3ff56701b611ac0e2c2589ef1f49cf8ac8fe/README.md","description_en":"Reconstructs C source for SCES_509.16, the PAL v2.00 PlayStation 2 executable of Ratchet & Clank (2002), with every function linked at its retail address. Functions not yet decompiled are still built from disassembly generated from the user's own executable, and the build audits functions, layout and the whole image against retail. The project documents an LLM-agent matching workflow and written build-fidelity rules for what counts as a match.","description_zh":"为 2002 年《Ratchet & Clank》PlayStation 2 欧版 v2.00 可执行文件 SCES_509.16 重建 C 源码，每个函数都链接在零售版的原地址。尚未反编译的函数仍由从使用者自备可执行文件生成的反汇编构建，构建会对照零售版审核函数、布局和整个映像。项目记录了由 LLM 代理执行匹配的流程，并以成文的构建保真规则界定何为匹配。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"banjo-recompiled-case","name":"Banjo: Recompiled — an N64Recomp Banjo-Kazooie native port","name_zh":"Banjo: Recompiled：基于 N64Recomp 的《Banjo-Kazooie》原生移植","url":"https://github.com/BanjoRecomp/BanjoRecomp","evidence_url":"https://github.com/BanjoRecomp/BanjoRecomp/blob/dbd52154bc1e00e56867b1fac94a8f907052f41b/README.md","description_en":"Uses N64Recomp to statically recompile the US 1.0 Nintendo 64 release of Banjo-Kazooie into a native port on N64ModernRuntime, rendered by RT64 and extended with mod support. Like Zelda 64: Recompiled, it is not built from decompiled source; a symbols repository generated from the Banjo-Kazooie decompilation supplies function names for locating code in the ROM and writing patches.","description_zh":"使用 N64Recomp 将美版 1.0 Nintendo 64《Banjo-Kazooie》静态重编译为基于 N64ModernRuntime 的原生移植版，由 RT64 渲染并加入模组支持。与 Zelda 64: Recompiled 一样，它并非基于反编译源码构建；由《Banjo-Kazooie》反编译项目生成的符号仓库提供函数名称，用于在 ROM 中定位代码和编写补丁。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokemon-firered-leafgreen-decomp-case","name":"Pokémon FireRed and LeafGreen: a matching Game Boy Advance decompilation","name_zh":"《宝可梦 火红／叶绿》：生成一致 ROM 的 Game Boy Advance 反编译重建","url":"https://github.com/pret/pokefirered","evidence_url":"https://github.com/pret/pokefirered/blob/037335f4c725d7c9aecdac87066f2002b4bd7e14/README.md","description_en":"Reconstructs the English Game Boy Advance releases of Pokémon FireRed and LeafGreen as buildable C source, with game scripts and data kept as assembler directives. Default agbcc builds produce six ROM images, covering both games' 1.0 and 1.1 releases and two variants labeled switch, each checked against its own SHA-1 manifest. Graphics and audio sources are committed in the tree, so the documented build reads no base ROM.","description_zh":"为 Game Boy Advance 英文版《宝可梦 火红／叶绿》重建可构建的 C 源码，游戏脚本和数据以汇编指令形式保存。默认的 agbcc 构建可生成六个 ROM 镜像，涵盖两款游戏的 1.0 与 1.1 版本及两个标为 switch 的变体，并分别按各自的 SHA-1 清单校验。图像和音频源文件已提交在仓库中，因此文档所述的构建流程不读取原 ROM。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"paperboat-paper-mario-port-case","name":"PaperBoat: a native Paper Mario port built on the decompilation","name_zh":"PaperBoat：基于反编译成果的 Paper Mario 原生移植","url":"https://github.com/HarbourMasters/PaperBoat","evidence_url":"https://github.com/HarbourMasters/PaperBoat/blob/d98b4b630f0674548067f59019fffef6885766e8/README.md","description_en":"Compiles Paper Mario decompilation sources, credited to the pmret and Paper Mario DX projects, into a native US-version application on libultraship. Torch converts the user’s own ROM into a local asset archive, and the port adds rendering backends, enhancements and archive-based mods. Desktop releases are published, while Android, iOS and web builds are documented on the development branch.","description_zh":"以 pmret 和 Paper Mario DX 项目为基础，将 Paper Mario 反编译源码编译为基于 libultraship 的原生美版应用。Torch 把使用者自己的 ROM 转换为本地素材归档，移植另加入多种渲染后端、增强功能和归档式模组。桌面版已有正式发布；Android、iOS 和网页构建则在开发分支中有文档说明。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"halo2-matching-decomp-case","name":"Halo 2: an agent-assisted matching decompilation of an LTCG Xbox build","name_zh":"Halo 2：智能体辅助的 LTCG Xbox 版一致性反编译","url":"https://github.com/kirklandsig/halo2-decompiled","evidence_url":"https://github.com/kirklandsig/halo2-decompiled/blob/e25e96f9236a74b15ab0f0acaa7af53918ca1233/README.md","description_en":"A work-in-progress matching decompilation of Halo 2 for the original Xbox: contributors write C and C++ that the period compiler, building the whole program with link-time code generation, must turn back into the retail executable's bytes function by function. The README reports just under half of the game-function bytes matched and leaves a native port for a later stage. It discloses that much of the maintainer's work runs in Claude and Codex coding-agent lanes.","description_zh":"Halo 2（初代 Xbox）的进行中一致性反编译：贡献者编写 C 与 C++ 代码，由原时代编译器以链接时代码生成方式构建整个程序，须逐函数还原出零售版可执行文件的字节。README 报告游戏函数字节的匹配比例接近一半，原生移植留待后续阶段。项目披露维护者的大量工作在 Claude 与 Codex 编程智能体流水线中进行。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"diabloweb-devilution-wasm-port-case","name":"DiabloWeb: a WebAssembly browser port built on Devilution","name_zh":"DiabloWeb：基于 Devilution 的 WebAssembly 浏览器移植","url":"https://github.com/d07RiV/diabloweb","evidence_url":"https://github.com/d07RiV/diabloweb/blob/c61ef19c54ea646aed328bd8cc82c8a5f1ebd81d/README.md","description_en":"Runs Diablo in web browsers by compiling a stripped-down fork of Devilution, the community reconstruction of the game’s original source, to WebAssembly behind a React front end. The fork removes the Storm, DiabloUI, DirectX and Windows dependencies and reworks event handling for the browser. It is a port built on a reconstruction and reports no matching or behavior-equivalence checks of its own.","description_zh":"将社区重建 Diablo 原始源码的 Devilution 精简分支编译为 WebAssembly，并配合 React 前端，使 Diablo 可在网页浏览器中运行。该分支移除了 Storm、DiabloUI、DirectX 和 Windows 依赖，并为浏览器改写事件处理。这是基于重建成果的移植，本身未报告一致性或行为等价检查。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokered-disassembly-case","name":"pokered: a matching Pokémon Red and Blue disassembly","name_zh":"pokered：一致构建的《精灵宝可梦 红／蓝》反汇编","url":"https://github.com/pret/pokered","evidence_url":"https://github.com/pret/pokered/blob/af519899719f0754965776faac0e836a3b906e6d/README.md","description_en":"Reconstructs the Game Boy games Pokémon Red and Blue as RGBDS assembly, with graphics and data kept as editable source files. One tree builds the USA/Europe Red and Blue ROMs, a Blue debug build and patches for the Virtual Console releases, each checked against a recorded SHA-1. It is a full disassembly rather than a decompilation into a higher-level language.","description_zh":"以 RGBDS 汇编重建 Game Boy 游戏《精灵宝可梦 红／蓝》，图像和数据以可编辑的源文件保存。同一源码树可构建美版／欧版红、蓝 ROM、一个蓝版调试构建以及 Virtual Console 版本的补丁，并逐一与记录的 SHA-1 比对。它是完整的反汇编项目，而非反编译为高级语言的源码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"lighthouse-banjo-kazooie-port-case","name":"Lighthouse: a Banjo-Kazooie PC port built on the decompilation","name_zh":"Lighthouse：基于反编译项目的《Banjo-Kazooie》PC 移植","url":"https://github.com/HarbourMasters/Lighthouse","evidence_url":"https://github.com/HarbourMasters/Lighthouse/blob/4e8dfd23c64b143eb93ae9ee9fbae832cae2a2ef/README.md","description_en":"A native Windows, Linux and macOS port of Banjo-Kazooie that compiles game C sources, many tagged with their Banjo-Kazooie decompilation file paths, against libultraship, a reimplementation of the N64 SDK. Torch extracts the user’s ROM into an asset archive, and the port adds Anchor multiplayer, romhack and language-pack support and a randomizer. Unlike Banjo: Recompiled, it builds from decompiled source rather than statically recompiling the ROM’s code.","description_zh":"一个面向 Windows、Linux 和 macOS 的《Banjo-Kazooie》原生移植，将游戏 C 源码（其中许多标注了《Banjo-Kazooie》反编译项目中的文件路径）与重新实现 N64 SDK 的 libultraship 一起编译。Torch 将用户的 ROM 提取为素材归档；移植版还加入了 Anchor 联机、ROM 修改版与语言包支持以及随机器。与 Banjo: Recompiled 不同，它基于反编译源码构建，而非对 ROM 代码进行静态重编译。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"lost-odyssey-recomp-case","name":"Lost Odyssey Recomp: statically recompiling an Xbox 360 RPG into native ports","name_zh":"Lost Odyssey Recomp：将 Xbox 360 角色扮演游戏静态重编译为原生移植","url":"https://github.com/freefrank/LostOdysseyRecomp","evidence_url":"https://github.com/freefrank/LostOdysseyRecomp/blob/32fb6f73efef0e34ac05913b8521bad026b4ff65/README.md","description_en":"Translates Lost Odyssey’s Xbox 360 PowerPC executable with patched XenonRecomp tooling and runs the generated code on a native runtime that renders through Direct3D 12, Vulkan or Metal. Windows, Linux, macOS and Android packages import the user’s own disc data. The maintainer documents development with Claude Code and Codex CLI and records each release separately from validation and acceptance.","description_zh":"使用打过补丁的 XenonRecomp 工具转换 Lost Odyssey 的 Xbox 360 PowerPC 可执行文件，并在原生运行时上运行生成代码，经 Direct3D 12、Vulkan 或 Metal 渲染。Windows、Linux、macOS 和 Android 安装包导入使用者自己的光盘数据。维护者记录了借助 Claude Code 与 Codex CLI 的开发过程，并把每次发布与验证、验收分开记录。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"melee-matching-decomp-case","name":"Super Smash Bros. Melee: a matching GameCube decompilation with a shiftable build","name_zh":"Super Smash Bros. Melee：可移位构建的 GameCube 一致性反编译","url":"https://github.com/doldecomp/melee","evidence_url":"https://github.com/doldecomp/melee/blob/f0cdbb0a7046aea44c7177fd72abf33c3d2af4d4/.github/README.md","description_en":"A matching decompilation of Super Smash Bros. Melee's US 1.02 release (GALE01) that rebuilds main.dol from C with the original Metrowerks compilers and checks it against the retail SHA-1. decomp.dev reports the code fully decompiled and linked at the reviewed commit, and the README says current work is mostly naming and cleanup. Because the build can be shifted, a separate non-matching mode lets modders add code to a DOL run with their own disc dump.","description_zh":"Super Smash Bros. Melee 美版 1.02（GALE01）的一致性反编译：使用原版 Metrowerks 编译器从 C 代码重建 main.dol，并与零售版的 SHA-1 比对。decomp.dev 报告所审提交的代码已完全反编译并链接，README 称目前工作主要是命名与清理。由于构建可以移位，另有非一致性模式，供模组作者加入代码，再配合自己转储的光盘运行生成的 DOL。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokecrystal-disassembly-case","name":"pokecrystal: a matching Pokémon Crystal disassembly","name_zh":"pokecrystal：一致构建的《精灵宝可梦 水晶》反汇编","url":"https://github.com/pret/pokecrystal","evidence_url":"https://github.com/pret/pokecrystal/blob/3bc8daa4173e96a7f4011dad3922eb6fa5dad5c6/README.md","description_en":"Reconstructs the Game Boy Color game Pokémon Crystal as RGBDS assembly, with graphics, maps and data stored as editable sources. One tree builds the international 1.0 and 1.1 releases, the Australian release, two debug builds and a Virtual Console patch, each checked against a recorded SHA-1. Companion documentation covers script command formats and known bugs in the original game.","description_zh":"以 RGBDS 汇编重建 Game Boy Color 游戏《精灵宝可梦 水晶》，图像、地图和数据以可编辑的源文件保存。同一源码树可构建国际版 1.0 与 1.1、澳大利亚版、两个调试构建以及一个 Virtual Console 补丁，并逐一与记录的 SHA-1 比对。配套文档说明脚本命令格式以及原版游戏中的已知错误。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokemon-heartgold-soulsilver-disassembly-case","name":"Pokémon HeartGold and SoulSilver: a work-in-progress, checksum-matched DS disassembly","name_zh":"《宝可梦 心金／魂银》：校验一致的进行中 DS 反汇编项目","url":"https://github.com/pret/pokeheartgold","evidence_url":"https://github.com/pret/pokeheartgold/blob/5bb4b3b4961cbf0f8a42360c58a3c045d8535069/README.md","description_en":"Rebuilds the US Nintendo DS releases of Pokémon HeartGold and SoulSilver from a work-in-progress disassembly in which part of the code has been decompiled to C. Each default build checks the ARM9 and ARM7 binaries, the filesystem and the complete ROM against per-game SHA-1 manifests. README warns that, because decompilation is incomplete, edits that change code or data layout can crash the game.","description_zh":"以进行中的反汇编项目重建美版 Nintendo DS《宝可梦 心金／魂银》，其中部分代码已反编译为 C。每次默认构建都会按各游戏的 SHA-1 清单校验 ARM9 与 ARM7 二进制、文件系统及完整 ROM。README 提醒，由于反编译尚未完成，改变代码或数据布局的修改可能导致游戏崩溃。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"fftarecomp-gba-static-recomp-case","name":"FFTARecomp: static recompilation of Final Fantasy Tactics Advance","name_zh":"FFTARecomp：Final Fantasy Tactics Advance 的静态重编译","url":"https://github.com/Jorge262007/FFTARecomp","evidence_url":"https://github.com/Jorge262007/FFTARecomp/blob/7af625665d40ef3d39b3730a3c591ff66f7b2929/README.md","description_en":"Recompiles the user’s Final Fantasy Tactics Advance (USA) Game Boy Advance ROM ahead of time into native code for Windows, Linux and Steam Deck, building on JRickey’s gba-recomp toolkit. ARM and Thumb code is translated to C and compiled locally, while a Rust runtime models the console’s graphics, sound, DMA, timers and BIOS calls. The port adds widescreen, zoom, fast-forward and remappable controls.","description_zh":"基于 JRickey 的 gba-recomp 工具链，将使用者自有的 Final Fantasy Tactics Advance（美版）Game Boy Advance ROM 预先重编译为可在 Windows、Linux 和 Steam Deck 上运行的原生代码。ARM 与 Thumb 代码被转译为 C 并在本地编译，Rust 运行时则模拟主机的图形、声音、DMA、定时器及 BIOS 调用。移植另行加入宽屏、缩放、快进和可重映射操作。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"symphonyrecomp-case","name":"SymphonyRecomp: a RecompOne static recompilation of Symphony of the Night","name_zh":"SymphonyRecomp：用 RecompOne 静态重编译《恶魔城：月下夜想曲》","url":"https://github.com/BlackLabelHQ/SymphonyRecomp","evidence_url":"https://github.com/BlackLabelHQ/SymphonyRecomp/blob/c94a9096bab25bf513cceea50d6838a4c8d7bf5b/README.md","description_en":"Statically recompiles the North American PlayStation release of Castlevania: Symphony of the Night into C# with BlackLabelHQ’s RecompOne, whose runtime simulates the BIOS, memory-mapped I/O, GPU and CD-ROM so the game runs natively without a console BIOS. Per-overlay function maps and patches add widescreen, quality-of-life, randomizer and cheat features. References from the SOTN decompilation help name functions, but the project stresses that it is a recompilation, not a decompilation.","description_zh":"使用 BlackLabelHQ 的 RecompOne 将北美 PlayStation 版《恶魔城：月下夜想曲》静态重编译为 C#；其运行时模拟 BIOS、内存映射 I/O、GPU 和光驱，使游戏无需主机 BIOS 即可原生运行。按覆盖段划分的函数映射与补丁加入了宽屏、便利性改进、随机器和作弊功能。项目借助 SOTN 反编译项目的资料为函数命名，但强调它是重编译而非反编译。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"two-towers-recompiled-case","name":"The Two Towers Recompiled: an original Xbox static-recompilation port","name_zh":"The Two Towers Recompiled：初代 Xbox 静态重编译移植","url":"https://github.com/Gumpolas/TooTawersRecomp","evidence_url":"https://github.com/Gumpolas/TooTawersRecomp/blob/6fce430797ec0573634fa6be18a08f73957efa63/README.md","description_en":"Statically recompiles the x86 code of The Lord of the Rings: The Two Towers (Xbox, USA, 2002) into C with the bundled xboxrecomp toolkit, producing native Windows, Linux and experimental macOS builds. The recompiled sources are generated locally from the player's own default.xbe, and game data comes from their disc image or extracted folder. README reports the game as fully playable, with visual, frame-rate and mod issues listed.","description_zh":"使用随附的 xboxrecomp 工具包，将《The Lord of the Rings: The Two Towers》（Xbox 美版，2002）的 x86 代码静态重编译为 C，生成原生 Windows、Linux 及实验性 macOS 构建。重编译源码由玩家自己的 default.xbe 在本地生成，游戏数据来自其光盘镜像或已提取的文件夹。README 报告游戏可以完整游玩，并列出画面、帧率和模组方面的问题。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"melee-unlocked-case","name":"Melee Unlocked: a Windows source port and static recompilation of Melee","name_zh":"Melee Unlocked：Melee 的 Windows 源码移植与静态重编译","url":"https://github.com/Hero88go/melee-unlocked","evidence_url":"https://github.com/Hero88go/melee-unlocked/blob/589415b70123e699226f1925ad7a59ef8203a71c/README.md","description_en":"A beta Windows build of Super Smash Bros. Melee (NTSC 1.02) with two engines: a source port that compiles the doldecomp decompilation as a native library, and a static recompilation that translates the retail DOL's PowerPC code and Slippi's Gecko codes into C++. Both run on a native runtime with Direct3D rendering, unlocked display rates and natively implemented Slippi rollback play. The user's own ISO supplies all game data, and the README says the work was AI-assisted.","description_zh":"Super Smash Bros. Melee（NTSC 1.02）的 Windows 测试版构建，包含两套引擎：源码移植将 doldecomp 反编译编译为原生库，静态重编译则将零售版 DOL 的 PowerPC 代码及 Slippi 的 Gecko 代码转换为 C++。两者都运行在原生运行时上，提供 Direct3D 渲染、解锁的显示帧率和原生实现的 Slippi 回滚对战。全部游戏数据来自使用者自备的 ISO，README 称开发借助了 AI。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokeruby-decomp-case","name":"pokeruby: a matching Pokémon Ruby and Sapphire decompilation","name_zh":"pokeruby：一致构建的《精灵宝可梦 红宝石／蓝宝石》反编译","url":"https://github.com/pret/pokeruby","evidence_url":"https://github.com/pret/pokeruby/blob/5784633ce4ef7ade1a7f2d2d0c288e3d5e6cdd7f/README.md","description_en":"Reconstructs the Game Boy Advance games Pokémon Ruby and Sapphire as C source built with pret's agbcc compiler, alongside assembly data scripts and editable graphics. Matching builds cover the English 1.0, 1.1 and 1.2 revisions, debug builds and the first German editions, each checked against a stored SHA-1. A separate modern-GCC target is not expected to match.","description_zh":"以 C 源码重建 Game Boy Advance 游戏《精灵宝可梦 红宝石／蓝宝石》，使用 pret 的 agbcc 编译器构建，并附有汇编数据脚本和可编辑图像。一致构建涵盖英文版 1.0、1.1、1.2 修订版、调试构建以及德文初版，并逐一与保存的 SHA-1 比对。另有使用现代 GCC 的构建目标，不以一致为目标。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"vandal-hearts-pc-port-case","name":"Vandal Hearts: native PC port built on matching decompilations","name_zh":"Vandal Hearts：基于一致性反编译的原生 PC 移植","url":"https://github.com/HalmyLyseas/VandalHearts-PcPort","evidence_url":"https://github.com/HalmyLyseas/VandalHearts-PcPort/blob/14552fffa0e0b47e02b57592e274fc6e7a649923/README.md","description_en":"Builds on shao113’s matching decompilation of PlayStation Vandal Hearts, adds a Japanese matching tree, and carries both through to a native Windows and Linux port. SDL2, OpenGL or Metal and OpenAL backends replace the console’s GPU, GTE, CD-ROM/XA, SPU, MDEC and pad interfaces, and one executable runs the USA, Asia and Japan discs. The matching builds are still checked on every change; PC-only features such as Tactical Mode and HD packs are opt-in.","description_zh":"以 shao113 的 PlayStation 版 Vandal Hearts 一致性反编译为基础，新增日版一致性代码树，并将两者延伸为原生 Windows 与 Linux 移植。SDL2、OpenGL 或 Metal 及 OpenAL 后端替代主机的 GPU、GTE、CD-ROM／XA、SPU、MDEC 和手柄接口，同一可执行文件可运行美版、亚洲版和日版光盘。每次修改仍须通过一致性构建检查；Tactical Mode、高清包等 PC 专属功能均为可选。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokemon-platinum-decomp-case","name":"Pokémon Platinum: a checksum-matched Nintendo DS decompilation","name_zh":"《宝可梦 白金》：校验一致的 Nintendo DS 反编译重建","url":"https://github.com/pret/pokeplatinum","evidence_url":"https://github.com/pret/pokeplatinum/blob/1dc13dcea40c04ab53f1f607de46023dc409ef20/README.md","description_en":"Reconstructs the US Nintendo DS release of Pokémon Platinum as C source that rebuilds revision 1 by default and revision 0 on request. The default make target runs Meson checks of the code binaries, filesystem and complete ROM against SHA-1 manifests. README still calls the project work in progress; its contributing guide says the code is entirely C but much of it remains obfuscated, leaving documentation and tooling as the main work.","description_zh":"将美版 Nintendo DS《宝可梦 白金》重建为 C 源码，默认重建修订版 1，也可按需构建修订版 0。默认的 make 目标会运行 Meson 检查，按 SHA-1 清单校验代码二进制、文件系统及完整 ROM。README 仍称项目在进行中；贡献指南表示代码已全部为 C，但其中大量仍晦涩难懂，因此主要工作是文档和工具。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"saints-reborn-recomp-case","name":"Saints Reborn: a ReXGlue static recompilation of Saints Row","name_zh":"Saints Reborn：基于 ReXGlue 的 Saints Row 静态重编译","url":"https://github.com/whompay/SaintsReborn","evidence_url":"https://github.com/whompay/SaintsReborn/blob/cb09c54cf9ff5c19a9c1cb8e080f465a322bd0eb/README.md","description_en":"An unofficial native Windows port of Saints Row (Xbox 360, 2006) that statically recompiles the game's PowerPC executable to C++ for x86-64 with the ReXGlue SDK, which also reimplements the console's kernel, GPU (on Direct3D 12), audio and input. A recompiler manifest, game-specific function overrides and an SDK patch make the result run, and each user builds it locally from their own disc. The README reports the game fully playable with built-in co-op and lists known issues.","description_zh":"Saints Row（Xbox 360，2006）的非官方原生 Windows 移植：借助 ReXGlue SDK 将游戏的 PowerPC 可执行文件静态重编译为面向 x86-64 的 C++ 代码，该 SDK 还重新实现了主机的内核、GPU（基于 Direct3D 12）、音频与输入。重编译清单、游戏专用的函数替换和 SDK 补丁使结果得以运行，每位使用者都用自己的光盘在本地构建。README 报告游戏可完整通关、内置合作模式，并列出已知问题。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokemon-platinum-pc-port-case","name":"Pokémon Platinum PC Port: a native port built on the pret decompilation","name_zh":"Pokémon Platinum PC Port：基于 pret 反编译的原生移植","url":"https://github.com/cybervisi0n/pokeplatinum","evidence_url":"https://github.com/cybervisi0n/pokeplatinum/blob/35067868f64f23d25d17ac3e536cfdd9a7f40523/README.md","description_en":"Builds native 64-bit Windows and Linux executables of Pokémon Platinum from a fork of pret’s decompilation, replacing NitroSDK with the author’s libntr libraries; the same tree keeps the DS ROM build and an experimental Switch target. README says the game should be playable from start to finish but may crash or show graphical bugs. Prebuilt binaries require the player’s own US ROM, and the fork’s default build no longer runs pret’s checksum tests.","description_zh":"基于 pret 反编译项目的分支，为《宝可梦 白金》构建原生 64 位 Windows 和 Linux 可执行文件，并以作者的 libntr 库替代 NitroSDK；同一源码树仍保留 DS ROM 构建和实验性的 Switch 目标。README 称游戏应可从头玩到尾，但可能出现崩溃和图形错误。预构建程序需要玩家自备美版 ROM，且该分支的默认构建不再运行 pret 的校验测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"mikupan-fatal-frame-port-case","name":"MikuPan: a native Fatal Frame PC port built on the Himuro decompilation","name_zh":"MikuPan：基于 Himuro 反编译的 Fatal Frame 原生 PC 移植","url":"https://github.com/Mikompilation/MikuPan","evidence_url":"https://github.com/Mikompilation/MikuPan/blob/ec204d75441e98d8bd43ddd95cae744eb683f00c/README.md","description_en":"Ports the PS2 game Fatal Frame to native PC builds without emulation; its repository description names the Himuro decompilation as its basis. Stubs replace PS2 kernel calls and a new SDL3-based layer handles rendering, audio and UI, while game data comes from the user’s own disc. The README calls the port very early work and publishes no matching or fidelity checks.","description_zh":"将 PS2 游戏 Fatal Frame（《零》）移植为无需模拟器的原生 PC 版本；仓库简介称其基于 Himuro 反编译项目。PS2 内核调用由桩函数替代，渲染、音频和界面由基于 SDL3 的新层实现，游戏数据则来自使用者自有的光盘。README 称移植仍处于很早期阶段，未发布一致性或还原度检查。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"starfox64-recompiled-case","name":"Starfox 64: Recompiled — an N64Recomp static-recompilation port","name_zh":"Starfox 64: Recompiled：基于 N64Recomp 的静态重编译移植","url":"https://github.com/sonicdcer/Starfox64Recomp","evidence_url":"https://github.com/sonicdcer/Starfox64Recomp/blob/f2996555d73ca480f3dc3639f375c50818847bfc/README.md","description_en":"Uses N64: Recompiled to statically recompile the US 1.1 (Rev A) Nintendo 64 release of Star Fox 64 into a native port for Windows, Linux and macOS, rendered with RT64. Its patches and enhancements draw on headers and some functions from the separate sf64 decompilation, but the port is not compiled from that decompilation's source. The README reports high-frame-rate, widescreen and mod support, with assets loaded from the user's own ROM.","description_zh":"使用 N64: Recompiled 将 Nintendo 64 版 Star Fox 64 美版 1.1（Rev A）静态重编译为面向 Windows、Linux 和 macOS 的原生移植，并以 RT64 渲染。补丁与增强功能借用独立的 sf64 反编译项目中的头文件和部分函数，但移植本身并非由该反编译源码编译而成。README 报告支持高帧率、宽屏与模组，素材从使用者自备的 ROM 载入。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"syphon-filter-omega-strain-decomp-case","name":"Syphon Filter: The Omega Strain — matching PS2 executable decompilation","name_zh":"Syphon Filter: The Omega Strain：可逐字节重建 PS2 可执行文件的一致性反编译","url":"https://github.com/zm2283145/syphon-filter-omega-strain-decomp","evidence_url":"https://github.com/zm2283145/syphon-filter-omega-strain-decomp/blob/d41eacc6dd89befed75fec21a02faaa2b5a4750c/README.md","description_en":"Reconstructs much of the NTSC-U PlayStation 2 executable of Syphon Filter: The Omega Strain as C; with the remaining functions kept as split assembly, the build reproduces the retail SCUS_972.64 byte for byte. Committed objdiff reports track per-function matching against the user’s own executable. This is a matching-decompilation case, not a PC port; progress figures remain project-reported.","description_zh":"将 Syphon Filter: The Omega Strain 北美版 PlayStation 2 可执行文件的大部分代码重建为 C；其余函数保留为拆分出的汇编，整体构建可逐字节重现零售版 SCUS_972.64。仓库提交的 objdiff 报告以使用者自备的可执行文件为基准，追踪逐函数的匹配进度。这是一致性反编译案例，不是 PC 移植；进度数字仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"animal-crossing-pc-port-case","name":"Animal Crossing: a native PC port of the GameCube decompilation","name_zh":"Animal Crossing：基于 GameCube 反编译成果的原生 PC 移植","url":"https://github.com/flyngmt/ACGC-PC-Port","evidence_url":"https://github.com/flyngmt/ACGC-PC-Port/blob/4099d246c927e75b4fd342ca13f4ac4395c55af5/README.md","description_en":"Runs Animal Crossing’s decompiled GameCube C code natively on 32-bit x86, replacing the GX graphics API with an OpenGL 3.3 translation layer and console services with SDL2-based platform code. Game assets are read at startup from the user’s own disc image instead of being shipped. It is a port built on ACreTeam’s ac-decomp, not a matching rebuild of the original executable.","description_zh":"让 Animal Crossing 反编译所得的 GameCube C 代码在 32 位 x86 上原生运行，用转换层把 GX 图形 API 映射到 OpenGL 3.3，并以基于 SDL2 的平台代码替代主机服务。游戏素材在启动时从使用者自己的光盘镜像读取，不随项目分发。这是基于 ACreTeam ac-decomp 的移植，而非与原可执行文件一致的重建。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"goldeneye-007-matching-decomp-case","name":"GoldenEye 007: matching Nintendo 64 decompilation for three releases","name_zh":"GoldenEye 007：覆盖三个版本的一致性 Nintendo 64 反编译","url":"https://github.com/n64decomp/007","evidence_url":"https://github.com/n64decomp/007/blob/c4356466796c697dfd298010b9bed261f9ed8c6a/readme.md","description_en":"Reconstructs GoldenEye 007’s Nintendo 64 code as C source that rebuilds the US, Japanese and PAL ROMs. Assets come from a user-supplied US ROM, with Japanese and PAL differences taken from their own ROMs, and the default build compares each output with a recorded SHA-1. The README still calls the project work in progress, while a mutable status page reports all 208 files done; it is distinct from the separately curated PC port.","description_zh":"将 GoldenEye 007 的 Nintendo 64 代码重建为 C 源码，可重新构建美版、日版和 PAL 版 ROM。素材取自使用者自备的美版 ROM，日版与 PAL 版的差异部分则取自各自的 ROM；默认构建会将每个产物与记录的 SHA-1 比对。README 仍称项目在进行中，而可变的状态页报告全部 208 个文件已完成；它与另行收录的 PC 移植不同。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"starship-sf64-pc-port-case","name":"Starship: a Star Fox 64 PC port built from the decompilation","name_zh":"Starship：基于反编译的 Star Fox 64 PC 移植","url":"https://github.com/HarbourMasters/Starship","evidence_url":"https://github.com/HarbourMasters/Starship/blob/3322643f0bbf80d2f8f7e1c0d2c4c578515f6c90/README.md","description_en":"A native PC port of Star Fox 64 that compiles the game's decompiled C code against libultraship, an N64 porting library that reimplements libultra and renders through Fast3D. On first run it uses the Torch tool to turn the user's US ROM into an asset archive, and it ships for Windows, Linux, macOS and Switch. The README of the separate Starfox 64: Recompiled static recompilation calls this port its sibling, built with different technology.","description_zh":"Star Fox 64 的原生 PC 移植：将游戏的反编译 C 代码与 libultraship 一同编译，该 N64 移植库重新实现了 libultra，并通过 Fast3D 渲染。首次运行时借助 Torch 工具把使用者的美版 ROM 转换为素材资源包，提供 Windows、Linux、macOS 和 Switch 版本。独立的静态重编译项目 Starfox 64: Recompiled 在其 README 中称本移植为采用不同技术的姊妹项目。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ctr-turbocharged-port-case","name":"CTR Turbocharged: a PC sourceport built on the Crash Team Racing decompilation","name_zh":"CTR Turbocharged：基于 Crash Team Racing 反编译成果的 PC 移植","url":"https://github.com/CameronRedmore/Crash-Team-Racing-Turbocharged","evidence_url":"https://github.com/CameronRedmore/Crash-Team-Racing-Turbocharged/blob/07d0c49f01d62dcb9887b455be27ce65728ee893/README.md","description_en":"Extends the Crash Team Racing: High Octane sourceport, which derives from the CTR Native port of the CTR-ModSDK PlayStation decompilation, into Windows and Linux builds with a native 3D renderer, selectable aspect ratios and frame rates up to 240 FPS. The decompiled game code still assumes 32-bit pointers and loads assets from the player’s own NTSC-U disc image. Renderer, timing and option tests exist, but device coverage and fidelity remain project-reported.","description_zh":"在 Crash Team Racing: High Octane 移植版基础上扩展而成；High Octane 源自基于 CTR-ModSDK PlayStation 反编译成果的 CTR Native 移植。本分支面向 Windows 与 Linux，提供原生 3D 渲染器、可选画面比例及最高 240 FPS 帧率。反编译游戏代码仍假定 32 位指针，并从玩家自备的 NTSC-U 光盘镜像读取素材。项目附有渲染、计时和选项测试，但设备覆盖与还原度仍为项目自述。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"the-darkness-recomp-case","name":"The Darkness Recomp: an Xbox 360 static recompilation with a native D3D11 renderer","name_zh":"The Darkness Recomp：配有原生 D3D11 渲染器的 Xbox 360 静态重编译","url":"https://github.com/portingpete/The-Darkness-Recomp","evidence_url":"https://github.com/portingpete/The-Darkness-Recomp/blob/98f0bcd49dfee90dfee968a3b75fd40e892c91e7/README.md","description_en":"Builds a native Windows x64 port of The Darkness by translating its Xbox 360 executable to C++ ahead of time with a patched XenonRecomp. A D3D11 renderer draws from the engine’s original geometry, shader sources and device state instead of interpreting console GPU packets. Gameplay coverage and Linux results are project-reported, and the author discloses OpenAI Codex assistance.","description_zh":"使用打过补丁的 XenonRecomp 将 Xbox 360 可执行文件提前转换为 C++，构建 The Darkness 的原生 Windows x64 移植。D3D11 渲染器直接使用引擎原有的几何数据、着色器源码和设备状态绘制，而不解释主机 GPU 命令包。游戏覆盖范围与 Linux 测试结果均为项目报告，作者披露开发中使用了 OpenAI Codex 辅助。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"mariokart64-recompiled-case","name":"MarioKart 64: Recompiled — a native port through N64Recomp static recompilation","name_zh":"MarioKart 64: Recompiled：通过 N64Recomp 静态重编译实现的原生移植","url":"https://github.com/sonicdcer/MarioKart64Recomp","evidence_url":"https://github.com/sonicdcer/MarioKart64Recomp/blob/3f72d2385cc995fea79e8fca81d886cb2bdce1de/README.md","description_en":"Statically recompiles the US Nintendo 64 release of Mario Kart 64 into a native Windows, Linux and macOS application with N64Recomp, rendering through RT64. The README distinguishes this from a source port: game code is translated from the user’s ROM, while headers and some functions from a decompilation fork support patches and enhancements. Enhancement, fidelity and input-lag claims are project-reported.","description_zh":"使用 N64Recomp 将北美版 Nintendo 64《马力欧卡丁车 64》静态重编译为 Windows、Linux 与 macOS 原生应用，并通过 RT64 渲染。README 将其与源码移植区分开：游戏代码由使用者提供的 ROM 转换而来，反编译分支中的头文件和部分函数用于实现补丁与增强。增强功能、还原度和输入延迟等说法均为项目自述。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"animal-crossing-gamecube-decomp-case","name":"Animal Crossing: matching GameCube decompilation","name_zh":"Animal Crossing：生成一致产物的 GameCube 反编译重建","url":"https://github.com/ACreTeam/ac-decomp","evidence_url":"https://github.com/ACreTeam/ac-decomp/blob/09ca8e8b5b24e6ab44047ee980cf0088ad7ecb4c/README.md","description_en":"Reconstructs Animal Crossing’s GameCube code as C and C++ source that rebuilds the USA release’s main executable and its foresta.rel module. The dtk-template build reads the original binaries and assets from a user-supplied disc image, then checks both outputs against SHA-1 hashes. A separate native PC port builds on it; completeness figures remain project-reported here.","description_zh":"将 Animal Crossing 的 GameCube 代码重建为 C 与 C++ 源码，可重新构建美版的主可执行文件及 foresta.rel 模块。基于 dtk-template 的构建从使用者自备的光盘镜像读取原始二进制与素材，再用 SHA-1 哈希校验两个产物。另有原生 PC 移植以它为基础；此处的完成度数字仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"kingdom-hearts-days-matching-decomp-case","name":"Kingdom Hearts 358/2 Days: a matching Nintendo DS decompilation","name_zh":"《王国之心 358/2 Days》：逐字节一致的 Nintendo DS 反编译重建","url":"https://github.com/Yokimitsuro/khdays-decomp","evidence_url":"https://github.com/Yokimitsuro/khdays-decomp/blob/261a89eaa8f65dd566ae0828b0b57c85c847a6ee/README.md","description_en":"Reconstructs the ARM9 program and overlays of the EU Nintendo DS release of Kingdom Hearts 358/2 Days as C that recompiles byte for byte with CodeWarrior. README reports all 306 modules byte-identical, with about 99.5% of functions in real C and library assembly counted separately; the ARM7 binary is outside its scope. The repository holds no ROM, game assets or extracted disassembly and produces no playable build.","description_zh":"将 Nintendo DS 欧版《王国之心 358/2 Days》的 ARM9 程序及覆盖模块重建为 C 源码，以 CodeWarrior 重新编译后逐字节一致。README 报告全部 306 个模块字节一致，约 99.5% 的函数为真正的 C，库自身的汇编另行统计；ARM7 二进制不在范围内。仓库不含 ROM、游戏素材或提取的反汇编，也不生成可玩版本。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"rtl-433","name":"rtl_433","name_zh":"rtl_433 ISM 频段设备无线协议解码器","url":"https://github.com/merbanan/rtl_433","evidence_url":"https://github.com/merbanan/rtl_433/blob/80f7bcc3a3dc6edf537544593bf367241a225215/README.md","description_en":"Receives and decodes transmissions from ISM-band devices such as weather sensors, remote controls, doorbells and alarm sensors, using RTL-SDR or SoapySDR receivers or recorded I/Q files, and emits decoded fields as JSON, CSV, MQTT and other outputs. For signals no built-in decoder recognizes, a pulse analyzer reports OOK/FSK timings and hints for a flexible -X decoder that slices frames into bits; its analysis guide leaves mapping those bits to values to the analyst, working from known readings.","description_zh":"接收并解码 ISM 频段设备（如气象传感器、遥控器、门铃和报警传感器）的无线传输，可使用 RTL-SDR 或 SoapySDR 接收机，也可读取录制的 I/Q 文件，并以 JSON、CSV、MQTT 等格式输出解码字段。对内置解码器无法识别的信号，脉冲分析器会报告 OOK/FSK 时序，并给出灵活 -X 解码器的提示，用于将帧切分为比特；按其分析指南，把这些比特对应到具体数值仍需分析者依据已知读数完成。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-18"},{"id":"decomp-me","name":"decomp.me","name_zh":"decomp.me 协作匹配反编译平台","url":"https://decomp.me","evidence_url":"https://github.com/decompme/decomp.me/blob/f5850753ef561a3d79e6eb7e96ff08e78154b91d/README.md","description_en":"Collaborative decompilation website for matching work: its compile service builds candidate source with a selected platform compiler, assembles the target assembly and diffs the two objects with asm-differ. m2c drafts initial decompilations for its MIPS, PowerPC, ARM and SuperH platforms. The 18 platform definitions span N64, PlayStation, PS2, PSP, GameCube/Wii, Wii U, DS, GBA, 3DS, Switch, Saturn, Dreamcast and Xbox 360 plus IRIX, Mac OS X, MS-DOS, Win32 and Android x86.","description_zh":"面向匹配反编译的协作网站：其编译服务用选定平台的编译器编译候选源码，汇编目标汇编代码，并用 asm-differ 对比两个目标文件。对其 MIPS、PowerPC、ARM 和 SuperH 平台，m2c 可生成初步反编译代码。18 个平台定义涵盖 N64、PlayStation、PS2、PSP、GameCube/Wii、Wii U、DS、GBA、3DS、Switch、Saturn、Dreamcast 和 Xbox 360，以及 IRIX、Mac OS X、MS-DOS、Win32 和 Android x86。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"thps1-decomp-native-port-case","name":"TonyWasAProSkater: a THPS1 native port forked from a matching decompilation","name_zh":"TonyWasAProSkater：派生自一致性反编译的 THPS1 原生移植","url":"https://github.com/LANCommander/TonyWasAProSkater","evidence_url":"https://github.com/LANCommander/TonyWasAProSkater/blob/23968e91391ccdeb35f45e1fe987a8a40085aa5f/README.md","description_en":"Ports Tony Hawk’s Pro Skater (PlayStation, USA) to native Windows and Linux builds from a fork of an in-progress matching decompilation of the retail executable. The decompilation recompiles reconstructed functions with a Psy-Q toolchain and compares them byte for byte with the user’s retail executable, while the port replaces PlayStation hardware and libraries with SDL2 and OpenGL services. Play needs the user’s own disc image; matching and gameplay results remain project-reported.","description_zh":"从一个仍在进行中的零售版可执行文件一致性反编译项目派生分支，将 Tony Hawk’s Pro Skater（PlayStation 美版）移植为原生 Windows 与 Linux 程序。反编译部分用 Psy-Q 工具链重新编译已重建的函数，并与使用者自备的零售可执行文件逐字节比对；移植部分则以 SDL2 和 OpenGL 服务取代 PlayStation 硬件和库。运行需使用者自备光盘镜像；一致性与可玩性结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pt-pc-port-case","name":"P.T. for PC: a behavior-based engine reimplementation that reads the PS4 data","name_zh":"P.T. PC 版：基于行为重新实现、读取 PS4 数据的引擎","url":"https://github.com/LoreanXavier/pt-pc","evidence_url":"https://github.com/LoreanXavier/pt-pc/blob/d0a9b8f8969588a9ab2b1db03a35854d3af63f2e/README.md","description_en":"Reimplements P.T.’s game logic in C++ on a new Vulkan engine that reads levels, models, textures, sounds, scripts and cutscenes from the user’s own PS4 copy at run time. The author documents reverse-engineered file formats and used the shadPS4 emulator as a behavior and frame reference. Fidelity to the original is author-reported, and the use of AI coding tools is disclosed.","description_zh":"在新的 Vulkan 引擎上用 C++ 重新实现 P.T. 的游戏逻辑，运行时从使用者自有的 PS4 版本读取关卡、模型、贴图、声音、脚本和过场动画。作者记录了逆向得出的文件格式，并以 shadPS4 模拟器作为行为与画面的对照参考。与原作的一致程度为作者报告，项目也披露使用了 AI 编程工具。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"spaghettikart-mk64-port-case","name":"SpaghettiKart: a native Mario Kart 64 port built on decompiled source","name_zh":"SpaghettiKart：基于反编译源码的《马力欧卡丁车 64》原生移植","url":"https://github.com/HarbourMasters/SpaghettiKart","evidence_url":"https://github.com/HarbourMasters/SpaghettiKart/blob/5073d2e3636cdb2794f4c845ee3bdec5ac4718c4/README.md","description_en":"Builds a native Mario Kart 64 port for Windows, Linux, macOS and Switch from source that keeps the Mario Kart 64 decompilation’s file layout, running on libultraship’s reimplemented N64 SDK. Its bundled Torch extractor converts the user’s US ROM into an asset archive, and the port adds mods, custom tracks and an editor. The README does not name its upstream decompilation, and no matching or fidelity checks are published.","description_zh":"基于沿用《马力欧卡丁车 64》反编译项目文件结构的源码，构建适用于 Windows、Linux、macOS 和 Switch 的原生移植，运行在 libultraship 重新实现的 N64 SDK 之上。随附的 Torch 提取器将使用者自备的美版 ROM 转换为素材归档，移植还增加了模组、自定义赛道和编辑器。README 未写明其上游反编译项目，也未发布一致性或还原度检查。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"animal-crossing-wild-world-decomp-case","name":"Animal Crossing: Wild World: matching Korean DS decompilation with differential runtime checks","name_zh":"Animal Crossing: Wild World：附差分运行检查的韩版 DS 一致性反编译重建","url":"https://github.com/banatic/acww-decomp","evidence_url":"https://github.com/banatic/acww-decomp/blob/c7e3256743367fe04ed1a47f9a0f57e2ab57a24f/README.md","description_en":"Reconstructs the ARM9 game code of Animal Crossing: Wild World’s Korean DS release as one C or C++ source per function, checked against the user’s ROM with the original Metrowerks compiler and linker. Each function also has a readable Clean rewrite, and an included DS interpreter compares the ROM code, natively compiled sources and rewrites on recorded play. Data sections, the ARM7 binary, the linked SDK libraries and regrouping into original source files remain outside the reconstruction.","description_zh":"将 Animal Crossing: Wild World 韩版 DS 游戏的 ARM9 游戏代码重建为每个函数一个 C 或 C++ 源文件，并用原版 Metrowerks 编译器和链接器对照使用者自己的 ROM 校验。每个函数另有可读的 Clean 改写版本，仓库自带的 DS 解释器在录制的游玩过程中比较 ROM 代码、原生编译的源码和改写版本。数据段、ARM7 程序、链接的 SDK 库及按原始源文件重新归组仍不在重建范围内。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"king-kong-recompiled-case","name":"King Kong Recompiled: an AI-developed Xbox 360 static recompilation","name_zh":"King Kong Recompiled：由 AI 开发的 Xbox 360 静态重编译","url":"https://github.com/TekRantGaming/king-kong-recompiled","evidence_url":"https://github.com/TekRantGaming/king-kong-recompiled/blob/c852d9f467201e9a02c1aaf099b65522535b3473/README.md","description_en":"Translates the Xbox 360 release of Peter Jackson's King Kong into native Windows code with the ReXGlue static-recompilation SDK, adding a launcher and display, control and graphics options. Project code completes streamed disc reads the way the console does, which README credits with getting past an opening freeze seen under Xenia. The author discloses that the port was made almost entirely with Claude Code, directed and tested by the repository owner.","description_zh":"借助 ReXGlue 静态重编译 SDK，将 Xbox 360 版 Peter Jackson's King Kong 转译为原生 Windows 代码，并加入启动器以及显示、操控和图形选项。项目代码按主机的方式完成流式光盘读取；README 称这使游戏越过了在 Xenia 中出现的开场卡死。作者披露，该移植几乎完全由 Claude Code 完成，仓库所有者负责指导和测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"reva-ghidra-mcp","name":"ReVa (Reverse Engineering Assistant)","name_zh":"ReVa 面向大模型工具设计的 Ghidra MCP 扩展","url":"https://github.com/cyberkaida/reverse-engineering-assistant","evidence_url":"https://github.com/cyberkaida/reverse-engineering-assistant/blob/a05a6b0a18649efd6d74ec8447bdadf8d468c365/README.md","description_en":"Ghidra extension that runs an MCP server inside Ghidra, giving agents decompilation with namespace and cross-reference context, symbol, string, data-type, structure and call-graph tools, program diffing, renaming and PyGhidra scripting. Its README attributes the project's distinction to tool design for LLM use: many small tools whose schemas tolerate other input, redirect correctable mistakes and return short fragments linked to related information. Assistant mode serves an open Ghidra project to several clients at once; headless mode starts Ghidra itself with session-scoped projects.","description_zh":"在 Ghidra 内运行 MCP 服务器的 Ghidra 扩展，为智能体提供附带命名空间与交叉引用上下文的反编译、符号、字符串、数据类型、结构体与调用图工具，以及程序比对、重命名和 PyGhidra 脚本执行。其 README 将项目的特点归于面向大模型使用的工具设计：提供许多小工具，其模式在给定结构之外也能容忍其他输入，把可纠正的错误反馈给模型，并返回附带相关信息链接的简短片段。助手模式可让多个客户端同时连接已打开的 Ghidra 项目；无界面模式则由 ReVa 自行启动 Ghidra，项目仅在会话期间存在。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-18"},{"id":"splat","name":"splat","name_zh":"splat 二进制拆分工具","url":"https://github.com/ethteck/splat","evidence_url":"https://github.com/ethteck/splat/blob/7548b9771e6f8418507b23434187fb07741af6d4/README.md","description_en":"Binary splitter for decompilation and modding projects: a YAML config says where and how to cut an N64 ROM or PSX, PS2 or PSP binary into code, data and asset segments. A scan phase disassembles code and data, with MIPS handled by spimdisasm; a split phase writes the files and a linker script for rebuilding the input. Custom segment types can extend the pipeline.","description_zh":"面向反编译与模组项目的二进制拆分工具：由 YAML 配置指定在何处、以何种方式把 N64 ROM 或 PSX、PS2、PSP 二进制切分为代码、数据和素材段。扫描阶段反汇编代码与数据，MIPS 部分由 spimdisasm 处理；拆分阶段写出文件以及用于重新构建输入文件的链接脚本。可编写自定义段类型扩展该流程。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"mario-party-4-decomp-case","name":"Mario Party 4: matching GameCube decompilation of the USA releases","name_zh":"Mario Party 4：美版 GameCube 一致性反编译重建","url":"https://github.com/mariopartyrd/marioparty4","evidence_url":"https://github.com/mariopartyrd/marioparty4/blob/5b01c79b4910525e3fc5aa312eddd6d014e7f337/README.md","description_en":"Reconstructs Mario Party 4’s GameCube main executable and REL modules as C source that rebuilds both USA releases. The build analyzes the user’s own disc image and checks every linked output against version-specific SHA-1 lists. PAL and Japanese work is stale and no PC port exists yet; matching results remain project-reported here.","description_zh":"将 Mario Party 4 的 GameCube 主程序和 REL 模块重建为 C 源码，可重新构建两个美版发行版本。构建会分析使用者自备的光盘镜像，并按各版本的 SHA-1 清单检查每个链接产物。欧版和日版工作已停滞，也尚无 PC 移植；此处的一致性结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"speedbreaker-nfs-most-wanted-case","name":"SpeedBreaker: statically recompiling Need for Speed: Most Wanted for Xbox 360","name_zh":"SpeedBreaker：对 Xbox 360 版《极品飞车：最高通缉》的静态重编译","url":"https://github.com/SpeedBreakerProject/speedbreaker","evidence_url":"https://github.com/SpeedBreakerProject/speedbreaker/blob/31849f5f1d275bf21987440cdc27d94071013656/README.md","description_en":"Translates the Xbox 360 executable of Need for Speed: Most Wanted (2005) into native C++ with a patched XenonRecomp and runs it on a project runtime that stands in for the console’s kernel, Xenos GPU, XMA audio and controllers. Releases target SteamOS, Linux and Apple silicon Macs, with an experimental iPhone and iPad build, while all game data comes from the player’s own US disc. Rendering and frame-pacing improvements are project-reported.","description_zh":"使用打过补丁的 XenonRecomp 将 Xbox 360 版《极品飞车：最高通缉》（2005）的可执行文件转换为原生 C++，并在项目自建的运行时上执行，由运行时代替主机的内核、Xenos GPU、XMA 音频和控制器。发布版面向 SteamOS、Linux 和 Apple 芯片 Mac，另有实验性的 iPhone 与 iPad 版本，所有游戏数据均来自玩家自有的美版光盘。渲染与帧节奏方面的改进均为项目自述。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"x64dbg-mcp-server","name":"x64dbg-MCP Server","name_zh":"x64dbg-MCP Server 调试器 MCP 插件","url":"https://github.com/duty1g/x64dbg-mcp-server","evidence_url":"https://github.com/duty1g/x64dbg-mcp-server/blob/18be30ab417a371fd441de68d7252d2bc1830f11/README.md","description_en":"Native x64dbg plugin, written in Zig for both x32dbg and x64dbg, that serves an MCP endpoint over streamable HTTP and SSE from inside the debugger. Agents can load or attach to a process, set software, hardware, memory and conditional breakpoints, step and trace, read registers, call stacks, threads, memory maps, imports, strings and cross-references, and run arbitrary x64dbg commands. A bundled SKILL.md guide tells agents to confirm the debugger state before every action.","description_zh":"以 Zig 编写、同时支持 x32dbg 与 x64dbg 的原生 x64dbg 插件，在调试器内部通过 streamable HTTP 和 SSE 提供 MCP 端点。智能体可以加载或附加进程，设置软件、硬件、内存及条件断点，单步与跟踪执行，读取寄存器、调用栈、线程、内存映射、导入表、字符串和交叉引用，并执行任意 x64dbg 命令。随附的 SKILL.md 指南要求智能体在每次操作前先确认调试器状态。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-18"},{"id":"sims-bustin-out-gba-decomp-case","name":"The Sims: Bustin' Out: an AI-driven partial GBA matching decompilation","name_zh":"The Sims: Bustin' Out：AI 驱动的部分 GBA 一致性反编译重建","url":"https://github.com/DaBrown95/tsbodp","evidence_url":"https://github.com/DaBrown95/tsbodp/blob/0beb04fdc3142a9860059600d1037725f1bc6c77/README.md","description_en":"Rebuilds the USA/Europe Game Boy Advance release of The Sims: Bustin' Out byte for byte while gradually replacing ROM regions with matching C compiled by agbcc. The README calls it an AI-driven experiment in which almost all code, analysis and tooling are AI-generated. Most of the ROM is still copied from the user’s dump, so whole-ROM equality does not mean the game has been decompiled.","description_zh":"逐字节重建 The Sims: Bustin' Out 的 Game Boy Advance 美欧版，并逐步用 agbcc 编译、结果一致的 C 代码替换 ROM 区域。README 称这是由 AI 驱动的实验，几乎所有代码、分析与工具都由 AI 生成。ROM 的大部分仍从使用者的转储中复制，因此整个 ROM 一致并不代表游戏已完成反编译。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"m2c","name":"m2c","name_zh":"m2c 匹配反编译器","url":"https://github.com/matt-kempster/m2c","evidence_url":"https://github.com/matt-kempster/m2c/blob/708d2d2cb2698f091a92492b328f73b24209f72d/README.md","description_en":"Decompiler for matching projects that turns GNU as-format 32-bit MIPS, ARM, PowerPC and SuperH assembly into draft C, with partial C++ support. A target combines platform, compiler (IDO, GCC or MetroWerks CodeWarrior) and language; context files supply types, and it can infer unknown struct fields and emit global initializers. The README places it alongside splat, asm-differ and decomp-permuter, and decomp.me calls it for initial decompilations.","description_zh":"面向匹配反编译项目的反编译器，将 GNU as 格式的 32 位 MIPS、ARM、PowerPC 和 SuperH 汇编转换为 C 代码初稿，并部分支持 C++。目标由平台、编译器（IDO、GCC 或 MetroWerks CodeWarrior）和语言组成；上下文文件提供类型信息，还能推断未知的结构体字段并生成全局变量初始化代码。README 将它与 splat、asm-differ 和 decomp-permuter 并列使用，decomp.me 也调用它生成初步反编译结果。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"destiny2-build-86657-reconstruction-report-case","name":"Destiny 2 build 86657: Sunrise/Dawn reconstruction research report","name_zh":"Destiny 2 build 86657：Sunrise／Dawn 重建研究报告","url":"https://github.com/isinternets/d2-research","evidence_url":"https://github.com/isinternets/d2-research/blob/9a5b58f1f8408ed48b01705e0138ee25050669f2/README.md","description_en":"A dated research report on the Sunrise/Dawn reconstruction of the archived Destiny 2 build 86657 client, which emulates platform sign-on and the examined Bungie service contracts locally and adds reconstructed mission host policy. It records transport, decoding, object creation, presentation and gameplay results separately, and keeps superseded conclusions with their cited sources. It documents the case rather than shipping the runtime implementation or a recovered Bungie backend; playthroughs and native results remain project-reported.","description_zh":"一份注明版本日期的研究报告，记录已归档 Destiny 2 build 86657 客户端的 Sunrise／Dawn 重建：在本地模拟平台登录与所考察的 Bungie 服务契约，并补充重建的任务主机策略。报告把传输、解码、对象创建、呈现与游戏玩法结果分开记录，并连同所引来源保留已被推翻的结论。它记录案例本身，不提供运行时实现，也不是恢复出的 Bungie 后端；通关与原生实验结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game","protocol"],"verified_at":"2026-10-18"},{"id":"svr2011-recomp-case","name":"SVR2011-Recomp: a ReXGlue recompilation of WWE SmackDown vs. Raw 2011","name_zh":"SVR2011-Recomp：借助 ReXGlue 重编译 WWE SmackDown vs. Raw 2011","url":"https://github.com/shaneomac1337/SVR2011-Recomp","evidence_url":"https://github.com/shaneomac1337/SVR2011-Recomp/blob/6a12d52d0e32adfca092b6474d584b97d459b148/README.md","description_en":"Translates the Xbox 360 executable of WWE SmackDown vs. Raw 2011 to C++ ahead of time with ReXGlue and builds it as a Windows program on a Vulkan runtime derived from Xenia. A hand-maintained manifest adds function entry points the automatic pass misses, and project patches address frame pacing, a music-player delay and pipeline stalls. Exhibition play is author-tested on one AMD GPU; career mode and online remain untested.","description_zh":"借助 ReXGlue 将 WWE SmackDown vs. Raw 2011 的 Xbox 360 可执行文件提前转换为 C++，并在源自 Xenia 的 Vulkan 运行时上构建为 Windows 程序。手工维护的清单补充自动分析遗漏的函数入口，项目补丁则处理帧节奏、音乐播放器延迟和渲染管线卡顿。作者仅在一款 AMD GPU 上测试了表演赛等模式；生涯模式与在线功能仍未测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"mcp-windbg","name":"mcp-windbg","name_zh":"mcp-windbg WinDbg 调试 MCP 服务器","url":"https://github.com/svnscha/mcp-windbg","evidence_url":"https://github.com/svnscha/mcp-windbg/blob/48e4350d57c44a38068be4f64e89a0fe60fe5c04/README.md","description_en":"Independent, community-built MCP server that runs Microsoft's cdb.exe and kd.exe headless, so agents can open and triage user-mode and kernel crash dumps, attach to cdb remote debug servers and KD kernel targets, and run arbitrary debugger commands in separately addressed sessions. Its README points users who want AI inside WinDbg to Microsoft's official WinDbg MCP and positions this project as an alternative for other MCP clients, remote HTTP use and batch dump triage; it calls itself a wrapper that runs real debugger commands, not an automatic fix.","description_zh":"由社区独立开发的 MCP 服务器，以无界面方式运行微软的 cdb.exe 和 kd.exe，使智能体能够打开并初步分析用户态与内核崩溃转储，连接 cdb 远程调试服务器和 KD 内核目标，并在可分别寻址的会话中执行任意调试器命令。其 README 建议希望在 WinDbg 内使用 AI 的用户选择微软官方的 WinDbg MCP，并把本项目定位为面向其他 MCP 客户端、远程 HTTP 使用和批量转储分析的替代方案；项目自称只是执行真实调试器命令的封装，而非自动修复工具。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-18"},{"id":"decomp-toolkit","name":"decomp-toolkit","name_zh":"decomp-toolkit GameCube/Wii 反编译工具包","url":"https://github.com/encounter/decomp-toolkit","evidence_url":"https://github.com/encounter/decomp-toolkit/blob/0645e16511814920ffb05b25615dd71f1af73e4c/README.md","description_en":"GameCube/Wii matching-decompilation toolkit that analyzes DOL and REL executables and, from a project configuration, splits them into relocatable objects plus an ldscript.lcf for CodeWarrior's linker, so decompiled objects can replace original ones while the relinked binary is checked against the original. Analysis covers function boundaries, a Metrowerks/SDK signature database, relocations, sections and data objects, and objects are written without an assembler. Its CLI also handles disc images, archives, compression formats, CodeWarrior demangling and DWARF dumps.","description_zh":"面向 GameCube/Wii 匹配反编译的工具包：分析 DOL 和 REL 可执行文件，按项目配置将其拆分为可重定位目标文件，并为 CodeWarrior 链接器生成 ldscript.lcf，使反编译出的目标文件可逐个替换原有部分，同时将重新链接的二进制与原版核对。分析涵盖函数边界、Metrowerks/SDK 签名库、重定位、节区和数据对象，且无需汇编器即可直接写出目标文件。其命令行还可处理光盘镜像、归档、压缩格式、CodeWarrior 符号还原和 DWARF 转储。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"snap64-recomp-case","name":"Snap64 Recomp: a static-recompilation port of Pokémon Snap","name_zh":"Snap64 Recomp：Pokémon Snap 的静态重编译移植","url":"https://github.com/JackandBeans/Snap64Recomp","evidence_url":"https://github.com/JackandBeans/Snap64Recomp/blob/cf53b89272b9db19059dd97eed2690ea1dd94844/README.md","description_en":"Uses N64Recomp to statically recompile the US Nintendo 64 release of Pokémon Snap into a native Windows, Linux, Steam Deck and macOS port rendered with RT64. The recompiler reads a relocatable ELF linked from the matching ethteck/pokemonsnap decompilation together with the user’s ROM, and game-side patches are modified copies of decompiled functions. The author reports building the port with Claude Code; results remain project-reported.","description_zh":"使用 N64Recomp 将 Pokémon Snap 美版 Nintendo 64 发行版静态重编译为原生 Windows、Linux、Steam Deck 和 macOS 移植，由 RT64 负责渲染。重编译器读取从一致性 ethteck/pokemonsnap 反编译项目链接出的可重定位 ELF 及使用者自备的 ROM，游戏侧补丁则是反编译函数的修改副本。作者报告借助 Claude Code 完成移植；各项结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"dead-rising-2-case-zero-recomp-case","name":"Dead Rising 2: Case Zero — an Xbox 360 XBLA static recompilation port","name_zh":"Dead Rising 2: Case Zero：Xbox 360 XBLA 游戏的静态重编译移植","url":"https://github.com/wivi514/Dead_Rising_2_Case_Zero_Xenon_Recomp","evidence_url":"https://github.com/wivi514/Dead_Rising_2_Case_Zero_Xenon_Recomp/blob/a1feb9dd7a61e23b4bcbb1afab8edf3439ee86ac/README.md","description_en":"Builds a native Windows, Linux, Steam Deck and Apple Silicon port of the XBLA game Dead Rising 2: Case Zero by statically recompiling its Xbox 360 code with patched XenonRecomp and translating its shaders with patched XenosRecomp. A purpose-built runtime supplies a Vulkan renderer, XMA audio, keyboard/mouse input and online co-op through the author’s XenonLive service. Completion and platform results are project-reported.","description_zh":"使用打过补丁的 XenonRecomp 静态重编译 Xbox 360 代码，并用打过补丁的 XenosRecomp 转换着色器，为 XBLA 游戏 Dead Rising 2: Case Zero 构建可在 Windows、Linux、Steam Deck 和 Apple Silicon Mac 上运行的原生移植。专门编写的运行时提供 Vulkan 渲染器、XMA 音频、键鼠输入，以及通过作者的 XenonLive 服务实现的在线合作。通关情况与各平台结果均为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"openra-engine-case","name":"OpenRA: an engine reimplementation reimagining early Westwood RTS games","name_zh":"OpenRA：重新诠释早期 Westwood 即时战略游戏的引擎重新实现","url":"https://github.com/OpenRA/OpenRA","evidence_url":"https://github.com/OpenRA/OpenRA/blob/e180e3225f3930272dd451917467631618f8976f/README.md","description_en":"Provides a C# engine for early Westwood real-time strategy games, with mods that reimagine Command & Conquer: Red Alert, Tiberian Dawn and Dune 2000. It loads the original games’ content through its own file-system, MiniYAML rules and Lua mission layers rather than running or recovering Westwood code. Gameplay and interface deliberately follow OpenRA’s own design, so it is not a faithful recreation of the original executables.","description_zh":"为早期 Westwood 即时战略游戏提供以 C# 编写的引擎，并以模组形式重新诠释 Command & Conquer: Red Alert、Tiberian Dawn 和 Dune 2000。它通过自己的文件系统、MiniYAML 规则和 Lua 任务层加载原游戏内容，而不是运行或恢复 Westwood 的代码。玩法和界面有意遵循 OpenRA 自身的设计，因此并非对原可执行文件的忠实重现。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"rizin","name":"Rizin","name_zh":"Rizin 逆向工程框架","url":"https://github.com/rizinorg/rizin","evidence_url":"https://github.com/rizinorg/rizin/blob/db112e55614b8635b42d7515a2790ca9fb4e5d05/README.md","description_en":"Command-line reverse-engineering framework that began as a fork of radare2. The rizin shell analyzes and disassembles binaries, debugs programs and works as a scriptable hex editor, while rz-* tools cover binary-format information, assembly, diffing, hashing, pattern search and FLIRT signatures. The README lists dozens of architectures, bytecode formats and file formats from ELF, PE and Mach-O to dyld caches and BIOS/UEFI images; rzpipe scripts it from Python, Rust, Go and other languages. Cutter is the separate GUI built on it.","description_zh":"源自 radare2 分支的命令行逆向工程框架。rizin 交互环境可分析和反汇编二进制、调试程序，并可用作可脚本化的十六进制编辑器；rz-* 系列工具提供二进制格式信息、汇编、差异比较、哈希、模式搜索和 FLIRT 签名等功能。README 列出数十种架构、字节码格式和文件格式，从 ELF、PE、Mach-O 到 dyld 缓存和 BIOS/UEFI 镜像；可通过 rzpipe 用 Python、Rust、Go 等语言编写脚本。Cutter 是基于它的独立图形界面。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"cheatengine-mcp-bridge","name":"Cheat Engine MCP Bridge","name_zh":"Cheat Engine MCP Bridge 进程内存分析桥接","url":"https://github.com/miscusi-peek/cheatengine-mcp-bridge","evidence_url":"https://github.com/miscusi-peek/cheatengine-mcp-bridge/blob/6bd7ce90479250a9b4b75e7944df9c105ecb2572/README.md","description_en":"Connects MCP clients to Cheat Engine through a Lua bridge script and a Python MCP server, so an agent can inspect a process the user runs under Cheat Engine: memory reads and value scans, pointer-chain resolution, structure dissection, RTTI class names, disassembly, cross-references and hardware or DBVM breakpoints. Further tool groups write memory, inject DLLs or code, automate input and use Cheat Engine's kernel-mode driver. The README limits it to educational and research use and disclaims multiplayer cheating and Terms of Service violations.","description_zh":"通过 Lua 桥接脚本和 Python MCP 服务器把 MCP 客户端连接到 Cheat Engine，使智能体能够检查用户在 Cheat Engine 下运行的进程：读取内存与扫描数值、解析指针链、剖析结构体、识别 RTTI 类名、反汇编、查找交叉引用，以及设置硬件或 DBVM 断点。另有工具组可写入内存、注入 DLL 或代码、自动化输入，并调用 Cheat Engine 的内核模式驱动。README 将其限定于教学和研究用途，并声明不支持多人游戏作弊或违反服务条款的行为。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"dead-rising-2-case-west-recomp-case","name":"Dead Rising 2: Case West — a sibling Xbox 360 XBLA static recompilation port","name_zh":"Dead Rising 2: Case West：同系列的 Xbox 360 XBLA 静态重编译移植","url":"https://github.com/wivi514/Dead_Rising_2_Case_West_Xenon_Recomp","evidence_url":"https://github.com/wivi514/Dead_Rising_2_Case_West_Xenon_Recomp/blob/cb7dc0f46cfc71961e37f8a20b07ad143a3e161a/README.md","description_en":"Builds a native Windows, Linux, Steam Deck and Apple Silicon port of the XBLA epilogue Dead Rising 2: Case West by statically recompiling its Xbox 360 code with patched XenonRecomp and translating its shaders with patched XenosRecomp. It shares most of its runtime with the author’s separate Case Zero port, executing the console GPU command stream on Vulkan with XMA audio and keyboard/mouse input. Completion and platform results are project-reported.","description_zh":"使用打过补丁的 XenonRecomp 静态重编译 Xbox 360 代码，并用打过补丁的 XenosRecomp 转换着色器，为 XBLA 尾声篇 Dead Rising 2: Case West 构建可在 Windows、Linux、Steam Deck 和 Apple Silicon Mac 上运行的原生移植。它与作者另一个 Case Zero 移植共用大部分运行时，在 Vulkan 上执行主机 GPU 命令流，并提供 XMA 音频和键鼠输入。通关情况与各平台结果均为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"decompiler-explorer","name":"Decompiler Explorer","name_zh":"Decompiler Explorer 反编译器对比服务","url":"https://dogbolt.org","evidence_url":"https://github.com/decompiler-explorer/decompiler-explorer/blob/a7b8381b610478f67b6dd35b6812878f08636c54/README.md","description_en":"Web service at dogbolt.org that runs one small uploaded executable through many decompilers and shows their C-like output side by side, described as Compiler Explorer in reverse. The pinned source has runners for angr, Binary Ninja, Boomerang, dewolf, Ghidra, Hex-Rays, Kuna, REC Studio, Reko, Relyze, RetDec, rev.ng and Snowman, which helps compare how different decompilers render the same code.","description_zh":"位于 dogbolt.org 的网络服务：将上传的单个小型可执行文件交给多款反编译器处理，并排显示它们输出的类 C 代码，自称“反向的 Compiler Explorer”。所固定版本的源码包含 angr、Binary Ninja、Boomerang、dewolf、Ghidra、Hex-Rays、Kuna、REC Studio、Reko、Relyze、RetDec、rev.ng 和 Snowman 的运行器，便于比较不同反编译器如何呈现同一段代码。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-18"},{"id":"wireshark-mcp","name":"Wireshark MCP","name_zh":"Wireshark MCP 基于 tshark 的协议解析服务器","url":"https://github.com/bx33661/Wireshark-MCP","evidence_url":"https://github.com/bx33661/Wireshark-MCP/blob/0e1b6595a2dcfe097133deb1c0c3128fb7a110d4/README.md","description_en":"MCP server that wraps tshark, and optionally other Wireshark command-line tools, so agents can query saved captures through Wireshark's dissectors: packet lists and details, stream following, arbitrary field extraction, protocol hierarchies and conversations, decode-as rules for non-standard ports, protocol preferences, TLS and WPA decryption with user-supplied keys, and one tool that applies preset fields and filters for 25 protocols such as Modbus, S7comm, MQTT, Zigbee and BLE. Separate security-heuristic, live-capture and capture-editing tools sit beside the dissection tools.","description_zh":"封装 tshark 及可选的其他 Wireshark 命令行工具的 MCP 服务器，使智能体能借助 Wireshark 的解析器查询已保存的抓包文件：数据包列表与详情、流追踪、任意字段提取、协议层级与会话统计、针对非标准端口的 decode-as 规则、协议首选项、使用用户提供的密钥进行 TLS 与 WPA 解密，以及一个为 Modbus、S7comm、MQTT、Zigbee、BLE 等 25 种协议套用预设字段和过滤器的工具。解析类工具之外，另有安全启发式检测、实时抓包和抓包文件编辑等独立工具。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["protocol"],"verified_at":"2026-10-18"},{"id":"simpsons-wrestling-recompiled-case","name":"The Simpsons Wrestling Recompiled: a psxrecomp PlayStation static recompilation","name_zh":"The Simpsons Wrestling Recompiled：基于 psxrecomp 的 PlayStation 静态重编译","url":"https://github.com/TekRantGaming/simpsons-wrestling-recompiled","evidence_url":"https://github.com/TekRantGaming/simpsons-wrestling-recompiled/blob/1aaee1a999f4dcc60dbf965a9ed9944373528469/README.md","description_en":"Translates the PlayStation game’s MIPS code to C with a pinned psxrecomp fork and builds Windows and Linux programs on its hardware-modelling runtime, with a launcher and a game-specific plugin. Without patching game code, the plugin adds 16:9 matches, 60 FPS by raising the emulated CPU clock and rescaling movement, intro skipping and unlocks. The user’s own NTSC-U disc image is required, and the measurements are author-reported.","description_zh":"借助固定版本的 psxrecomp 分支，将这款 PlayStation 游戏的 MIPS 代码转换为 C，并基于其模拟硬件行为的运行时构建 Windows 与 Linux 程序，另附启动器和专用插件。插件在不修补游戏代码的前提下，实现比赛中的 16:9 画面、通过提高模拟 CPU 频率并修正移动量达到 60 FPS、跳过片头及全部解锁。需使用者自备 NTSC-U 光盘镜像；测量结果为作者报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"openrct2-engine-case","name":"OpenRCT2: an open re-implementation of RollerCoaster Tycoon 2","name_zh":"OpenRCT2：RollerCoaster Tycoon 2 的开源重新实现","url":"https://github.com/OpenRCT2/OpenRCT2","evidence_url":"https://github.com/OpenRCT2/OpenRCT2/blob/53bbc400e28be44d3c2e56fa514d5f65b61a64d4/readme.md","description_en":"Re-implements RollerCoaster Tycoon 2, originally written in x86 assembly, as a C++ engine that runs on the original game’s data. It loads RCT2 saves and scenarios, and RCT1 scenarios when those files are present, while saving to its own documented park format. Modern-platform support, interface and AI changes, higher limits and multiplayer are deliberate extensions, not reproductions of the original.","description_zh":"以 C++ 引擎重新实现原本用 x86 汇编编写的 RollerCoaster Tycoon 2，并在原游戏数据上运行。它可载入 RCT2 存档和场景，具备相应文件时也能载入 RCT1 场景，而保存时使用自己有文档说明的乐园格式。现代平台支持、界面与 AI 改动、更高上限和多人游戏都是有意扩展，并非对原版的复现。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"th06-decomp-case","name":"Touhou 6: reconstructing Embodiment of Scarlet Devil 1.02h source","name_zh":"Touhou 6：重建东方红魔乡 1.02h 版源码","url":"https://github.com/GensokyoClub/th06","evidence_url":"https://github.com/GensokyoClub/th06/blob/e840ab447f38579c2ea877e16a5d91a49adf016e/README.md","description_en":"Reconstructs C++ source for the Windows executable of Touhou 6: Embodiment of Scarlet Devil version 1.02h, aiming at an exact rebuild with the original Visual Studio .NET 2002 and DirectX 8 toolchain. reccmp and objdiff compare the rebuilt binary with the user’s original executable function by function. The committed progress badge reports every function implemented but 98.03% byte accuracy, so whole-binary identity is not claimed.","description_zh":"为 Touhou 6：东方红魔乡 1.02h 版的 Windows 可执行文件重建 C++ 源码，目标是用原版 Visual Studio .NET 2002 与 DirectX 8 工具链精确重新构建。reccmp 和 objdiff 将重建的二进制与使用者自备的原可执行文件逐函数比较。仓库内的进度徽章报告函数已全部实现、字节准确率为 98.03%，因此不主张整个二进制完全一致。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"binny-agent-harness","name":"BINNY","name_zh":"BINNY 逆向分析智能体框架","url":"https://github.com/openbin-ai/binny","evidence_url":"https://github.com/openbin-ai/binny/blob/000b6aca8c9d266b38252470102ac16c98575cd8/README.md","description_en":"An open-source terminal agent harness from OpenBin that runs a user-chosen hosted or local model over binary-analysis data. It reads decompiled functions, strings, imports and data from an OpenBin or OpenAPK project or a local Ghidra container run, follows triage, investigation and drafting playbooks, and saves a draft malware-analysis or vulnerability-research report for human review. It is an analysis harness with draft outputs, not a reconstruction project.","description_zh":"OpenBin 推出的开源终端智能体框架，让使用者自选的托管或本地模型处理二进制分析数据。它从 OpenBin 或 OpenAPK 项目、或本地 Ghidra 容器的分析结果中读取反编译函数、字符串、导入表和数据，按分诊、调查与起草流程工作，并保存恶意软件分析或漏洞研究报告草稿供人工审阅。它是输出草稿的分析框架，而非重建项目。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["app","binary","firmware"],"verified_at":"2026-10-18"},{"id":"rkd-telemetry-extractor-case","name":"RKD Telemetry Extractor: decoding Race-Keeper track-day recordings","name_zh":"RKD Telemetry Extractor：解读 Race-Keeper 赛道日录制数据","url":"https://github.com/sam-dumont/rkd-telemetry-extractor","evidence_url":"https://github.com/sam-dumont/rkd-telemetry-extractor/blob/8db9f373e1a7162d3f2efa297986bdfa86d9400f/RESEARCH_NOTES.md","description_en":"Documents the proprietary .rkd telemetry format written by Race-Keeper “Instant Video” recorders, whose bundled player runs only on Windows, and implements matching Python and Go parsers that export GPS and IMU channels as Telemetry Overlay CSV and GPX. The author credits Claude Code with the hex-dump analysis and hypothesis testing, anchored by known car IDs, circuit location and speeds. Field meanings rest on physical cross-checks from the author’s own recordings, and several record types remain partly unknown.","description_zh":"记录 Race-Keeper “Instant Video” 记录仪所写的专有 .rkd 遥测格式（随附播放器仅支持 Windows），并以结果一致的 Python 与 Go 解析器把 GPS 和 IMU 通道导出为 Telemetry Overlay CSV 与 GPX。作者称十六进制分析和假设检验由 Claude Code 协助完成，并以已知车辆编号、赛道位置和车速作为锚点。字段含义依据作者自有录制数据的物理交叉核对得出，若干记录类型仍未完全解读。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-18"},{"id":"pwndbg","name":"pwndbg","name_zh":"pwndbg GDB/LLDB 调试增强插件","url":"https://github.com/pwndbg/pwndbg","evidence_url":"https://github.com/pwndbg/pwndbg/blob/3044ccdf938221e04241e85fe02961ef174ef975/README.md","description_en":"Python plug-in that loads into GDB, or runs as a REPL around LLDB, to make live program state easier to inspect. Each stop prints a context of registers, stack, call frames and annotated disassembly with recursively dereferenced pointers; commands cover memory maps, search, telescoping, heap allocators and Go values, with Capstone/Unicorn emulation and decompiler integration for IDA, Binary Ninja, Ghidra and angr-management. The README lists Linux ELF, macOS Mach-O, QEMU user/system and embedded Cortex-M or RISC-V/32 debugging.","description_zh":"可加载到 GDB 中、或作为 LLDB 外层 REPL 运行的 Python 插件，使运行中程序的状态更易检查。每次停下时都会打印寄存器、栈、调用帧和带注释的反汇编等上下文，并递归解引用指针；命令涵盖内存映射、搜索、内存链式查看、堆分配器和 Go 值，还借助 Capstone/Unicorn 模拟执行指令，并可与 IDA、Binary Ninja、Ghidra 和 angr-management 反编译器集成。README 列出 Linux ELF、macOS Mach-O、QEMU 用户态／系统态以及嵌入式 Cortex-M 或 RISC-V/32 调试场景。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-18"},{"id":"driver-recomp-setup-host-case","name":"Driver Recompiled: a psxrecomp setup host that builds the game locally","name_zh":"Driver Recompiled：在本地构建游戏的 psxrecomp 安装宿主","url":"https://github.com/alexbeavs-ps1-ports/driver-recomp","evidence_url":"https://github.com/alexbeavs-ps1-ports/driver-recomp/blob/11e9a4a8c8fcf931e4ef70121d231a5a3cb5c42b/README.md","description_en":"Packages a psxrecomp static-recompilation project for Driver (PlayStation, USA) as a setup host: releases carry the recompiler, runtime and a recomp-ui launcher, and the player’s machine generates and compiles the game from the user’s own disc image. The repository holds configuration, Ghidra-derived function seeds and release automation rather than game code. Its documented status is thin: an operator-confirmed private build reaches gameplay, while package release gates remain open.","description_zh":"将 Driver（PlayStation 美版）的 psxrecomp 静态重编译项目打包为“安装宿主”：发布包含重编译器、运行时和 recomp-ui 启动器，再由玩家电脑依据使用者自备的光盘镜像生成并编译游戏。仓库只包含配置、来自 Ghidra 的函数种子和发布自动化脚本，不含游戏代码。文档记录的状态较为有限：维护者确认一个私有构建可以进入游戏，而发布包的验收门槛仍未完成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"himuro-fatal-frame-decomp-case","name":"Himuro: a matching Fatal Frame PS2 decompilation","name_zh":"Himuro：Fatal Frame（《零》）PS2 一致性反编译","url":"https://github.com/Mikompilation/Himuro","evidence_url":"https://github.com/Mikompilation/Himuro/blob/595b082aef19c329a25dc6926e4ac638d13ed75d/README.md","description_en":"Reconstructs Fatal Frame’s PS2 executable as C for the US, EU and Japanese releases, built with the original EE-GCC 2.9 toolchain and checked by SHA-1 against the user’s own executables. Committed objdiff reports list the US and EU code as fully matched and the Japanese code as partial, and a few routines still rely on assembly or byte patches. Porting to modern hardware is a stated later goal, not part of this repository.","description_zh":"将 Fatal Frame（《零》）PS2 可执行文件的美版、欧版和日版重建为 C，使用原始的 EE-GCC 2.9 工具链构建，并以使用者自备可执行文件的 SHA-1 校验结果。仓库提交的 objdiff 报告显示美版和欧版代码已全部匹配、日版仅部分匹配，少数例程仍依赖汇编或字节补丁。移植到现代硬件是项目声明的后续目标，不在本仓库范围内。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"doaxvb-native-port-case","name":"DOAXVB Native PC Port: statically recompiling Dead or Alive Xtreme Beach Volleyball","name_zh":"DOAXVB Native PC Port：对《Dead or Alive Xtreme Beach Volleyball》的静态重编译","url":"https://github.com/NoRain211/doaxvb-re","evidence_url":"https://github.com/NoRain211/doaxvb-re/blob/e282a3fc15c793e621098fc0a5d9e70aa6a6e9c2/README.md","description_en":"Lifts the original Xbox executable of Dead or Alive Xtreme Beach Volleyball to C with a fork of xboxrecomp and links it with a hand-written runtime that replaces kernel imports, audio and key Direct3D 8 and DirectSound APIs. Setup builds the runner locally from the user’s USA disc image and checks generated files against hashes in an authenticated recipe; releases carry only tools and source. Rewriting game logic as readable source has so far reached only the startup thread entry.","description_zh":"借助 xboxrecomp 的分支将原版 Xbox《Dead or Alive Xtreme Beach Volleyball》可执行文件提升为 C 代码，并与手写运行时链接，由运行时替代内核导入、音频以及关键的 Direct3D 8 和 DirectSound API。安装程序依据使用者自有的美版光盘镜像在本地构建运行程序，并按经认证配方中的哈希校验生成文件；发布包只含工具和源码。将游戏逻辑改写为可读源码的工作目前只完成了启动线程入口。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"elgato-hdr-uvc-capture-case","name":"Elgato HDR: a userspace capture path for the Elgato 4K X’s 10-bit mode","name_zh":"Elgato HDR：为 Elgato 4K X 的 10 位模式提供用户态采集通路","url":"https://github.com/talkaboutdesign/elgato-hdr","evidence_url":"https://github.com/talkaboutdesign/elgato-hdr/blob/7799d3c53520bcc3dd049211244bfaf49b905cb0/README.md","description_en":"A native macOS app that reaches the Elgato 4K X capture card’s 10-bit P010 video mode, which the project says Apple’s built-in webcam driver does not expose to apps. A root helper detaches that driver and runs the card’s USB Video Class streaming directly through libusb, feeding a Metal HDR viewer, an HDR10 recorder and an editor. Latency figures and device coverage remain author-reported.","description_zh":"一款原生 macOS 应用，用于获取 Elgato 4K X 采集卡的 10 位 P010 视频模式；项目称苹果内置的摄像头驱动不会向应用开放该模式。一个 root 权限辅助程序卸下该驱动，通过 libusb 直接执行采集卡的 USB 视频类（UVC）串流，为 Metal HDR 预览、HDR10 录制和编辑器提供画面。延迟数据和设备覆盖范围仍为作者报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"ido-static-recomp","name":"ido-static-recomp","name_zh":"ido-static-recomp IRIX IDO 编译器静态重编译工具","url":"https://github.com/decompals/ido-static-recomp","evidence_url":"https://github.com/decompals/ido-static-recomp/blob/d5aec59932034b8a20f23f471297a55c45dcbc45/README.md","description_en":"Statically recompiles the IRIX MIPS programs of SGI's IDO 5.3 and 7.1 C toolchain, such as cc, cfe, uopt, ugen and as1, into native Linux, macOS and Windows executables, so matching decompilation projects can build with the original compiler code on modern hosts. It recompiles compilers, not games: it neither decompiles nor translates game code.","description_zh":"将 SGI IDO 5.3 与 7.1 C 工具链中的 IRIX MIPS 程序（如 cc、cfe、uopt、ugen 和 as1）静态重编译为原生 Linux、macOS 和 Windows 可执行文件，使匹配式反编译项目能在现代主机上以原始编译器代码进行构建。它重编译的是编译器而非游戏，本身既不反编译也不转换游戏代码。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"th08-web-wasm-port-case","name":"TH08 Web: a WebAssembly port built from reconstructed source","name_zh":"TH08 Web：基于重建源码的 WebAssembly 移植","url":"https://github.com/N0zoM1z0/th08-web","evidence_url":"https://github.com/N0zoM1z0/th08-web/blob/e3485ab9a9af3b5a90ce51841667bbdf5a867e5c/README.md","description_en":"Compiles the reconstructed C++ source of the Japanese Touhou 8 1.00d release to WebAssembly with Emscripten, adding WebGL 2 rendering, Web Audio, browser input and IndexedDB saves behind the game’s D3D8-, DirectSound- and DirectInput-shaped interfaces. Players select their own retail DAT files locally. The web build makes no binary-exact claim and is a separate port from the curated TH08 reconstruction.","description_zh":"使用 Emscripten 将日版 Touhou 8 1.00d 的重建 C++ 源码编译为 WebAssembly，并在游戏原有的 D3D8、DirectSound 与 DirectInput 形态接口之后接入 WebGL 2 渲染、Web Audio、浏览器输入和 IndexedDB 存档。玩家在本地选择自备的正版 DAT 文件。网页构建不主张与原二进制逐字节一致，是独立于已收录 TH08 重建的移植。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ipsw","name":"ipsw","name_zh":"ipsw Apple 固件研究工具包","url":"https://github.com/blacktop/ipsw","evidence_url":"https://github.com/blacktop/ipsw/blob/a9eae76e8b1e901e4a03dd530defac8a1b33f91a/README.md","description_en":"Command-line toolkit for Apple firmware research and reverse engineering. It downloads and unpacks IPSWs, OTAs and KDKs and compares builds; inspects Mach-O load commands, symbols, signatures and entitlements with ARM64 disassembly; finds symbols and cross-references in dyld shared caches, extracts dylibs and dumps Objective-C headers and Swift metadata; extracts KEXTs and compares kernelcaches; and parses IMG4, decrypts AEA archives and inspects iBoot and coprocessor firmware.","description_zh":"面向 Apple 固件研究与逆向工程的命令行工具包。可下载并解包 IPSW、OTA 和 KDK 并比较不同构建；检查 Mach-O 的加载命令、符号、签名和权限，并反汇编 ARM64 代码；在 dyld 共享缓存中查找符号和交叉引用、提取 dylib、导出 Objective-C 头文件并查看 Swift 元数据；提取 KEXT 并比较 kernelcache；还能解析 IMG4、解密 AEA 归档，以及检查 iBoot 和协处理器固件。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["app","binary","firmware"],"verified_at":"2026-10-18"},{"id":"openxcom-engine-case","name":"OpenXcom: an open-source clone of X-COM: UFO Defense and Terror from the Deep","name_zh":"OpenXcom：X-COM: UFO Defense 与 Terror from the Deep 的开源克隆","url":"https://github.com/OpenXcom/OpenXcom","evidence_url":"https://github.com/OpenXcom/OpenXcom/blob/4a4bae5fa2e5a09282928e84943fc84b093e34ff/README.md","description_en":"Reimplements MicroProse’s UFO: Enemy Unknown (X-COM: UFO Defense) and X-COM: Terror from the Deep as a C++/SDL engine that runs on the user’s original game resources. Game data such as items, craft, research and missions is expressed in YAML rulesets, which also carry its standard mods and a wider modding ecosystem. It is a clone that reuses original content, not recovered MicroProse code.","description_zh":"以 C++/SDL 引擎重新实现 MicroProse 的 UFO: Enemy Unknown（X-COM: UFO Defense）与 X-COM: Terror from the Deep，并在使用者自己的原游戏资源上运行。物品、飞行器、研究和任务等游戏数据以 YAML 规则集表达，这些规则集也承载其标准模组及更广泛的模组生态。这是复用原内容的克隆实现，而非恢复出的 MicroProse 代码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"skate3-recomp-case","name":"Skate 3 Recomp: a native Xbox 360 recompilation through ReXGlue","name_zh":"Skate 3 Recomp：通过 ReXGlue 实现的 Xbox 360 原生重编译","url":"https://github.com/mchughalex/skate3recomp","evidence_url":"https://github.com/mchughalex/skate3recomp/blob/f6e0ae87fdfecbadb5c1e36c55d66a744187a3cd/README.md","description_en":"Recompiles the Xbox 360 version of Skate 3 into native Windows, Linux and macOS builds with a Skate-specific fork of the ReXGlue SDK. Since v2.0.0 a native Direct3D 12 and Vulkan renderer with ports of the game’s own material shading replaces emulation of the Xbox 360 GPU, which remains as a fallback. Game files come from the user’s disc image; the author calls the native renderer early and has not tested the game end to end.","description_zh":"借助 ReXGlue SDK 的 Skate 专用分支，将 Xbox 360 版《Skate 3》重编译为 Windows、Linux 与 macOS 原生版本。自 v2.0.0 起，基于 Direct3D 12 和 Vulkan、移植了游戏自身材质着色的原生渲染器取代对 Xbox 360 GPU 的模拟，模拟渲染器保留为后备。游戏文件来自使用者的光盘镜像；作者称原生渲染器尚处早期，且尚未完整测试整个游戏。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"decomp-wtf-agent-decompilation","name":"decomp.wtf","name_zh":"decomp.wtf 智能体反编译工具","url":"https://github.com/i12bp8/decomp.wtf","evidence_url":"https://github.com/i12bp8/decomp.wtf/blob/575b4a30ed481ff5497dfb9ce4f599368a95a04a/README.md","description_en":"A discontinued local app and MCP server that hands AI coding agents one function of a user-owned console game at a time, compiles each C attempt with the game’s period compiler and accepts it only when the linked result matches the original bytes. It can start a project from a ROM or disc image, or work inside forks of public decompilation projects listed on decomp.dev, where objdiff judges the result. Its final commit, dated 15 October 2026, marks it discontinued in response to opposition in the decompilation community; the code stays under MIT without further fixes or releases.","description_zh":"一款已停止开发的本地应用与 MCP 服务，把用户自有主机游戏的函数逐个交给 AI 编程智能体，用该游戏当年的编译器编译每次提交的 C 代码，只有链接后的结果与原始字节一致才算通过。它可从 ROM 或光盘镜像新建项目，也可在 decomp.dev 所列公开反编译项目的分叉中工作，由 objdiff 判定结果。其 2026 年 10 月 15 日的最后一次提交宣布停止开发，理由是反编译社区的反对；代码仍以 MIT 许可保留，但不再修复或发布新版本。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["game"],"verified_at":"2026-10-18"},{"id":"uncharted-collection-pc-port-case","name":"Uncharted: The Nathan Drake Collection native Windows port","name_zh":"《神秘海域：内森·德雷克合集》原生 Windows 移植","url":"https://github.com/bc160201983/Uncharted-The-Nathan-Drake-Collection-PC-port","evidence_url":"https://github.com/bc160201983/Uncharted-The-Nathan-Drake-Collection-PC-port/blob/dfc9fb6e70794bc81ae62836e3e5fb993ff50b3e/README.md","description_en":"Runs the PS4 Uncharted: The Nathan Drake Collection’s own x86-64 executables natively on Windows: a runtime supplies the PS4 system libraries and a shadPS4-derived Vulkan renderer executes the GPU work. The port adds a per-game launcher, resolution patches and modern upscaling, and its status table reports all three games playable with listed open issues. It is a compatibility-runtime port rather than a decompilation, and its results remain project-reported.","description_zh":"在 Windows 上原生运行 PS4 版《神秘海域：内森·德雷克合集》自身的 x86-64 可执行文件：由运行时提供 PS4 系统库，并以源自 shadPS4 的 Vulkan 渲染器执行 GPU 工作。该移植提供按游戏保存设置的启动器、分辨率补丁与现代超分辨率技术，其状态表报告三部游戏均可游玩，并列出未解决问题。这是兼容运行时移植而非反编译重建，结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"th095-reconstruction-case","name":"TH095: function-level reconstruction of Shoot the Bullet 1.02a","name_zh":"TH095：东方文花帖 1.02a 的函数级重建","url":"https://github.com/N0zoM1z0/th095","evidence_url":"https://github.com/N0zoM1z0/th095/blob/6084b36cfa90ac1720f0cba36caec3ee56fc5e1f/README.md","description_en":"Reconstructs source for the original Japanese Touhou 9.5: Shoot the Bullet 1.02a executable, accepting function exactness only through reproducible byte comparison of pinned Visual C++ .NET 2003 builds against one hash-attested target. The whole program also compiles and links into a playable Windows i386 executable, while README keeps playability, function matching and whole-executable identity as separate statuses.","description_zh":"为日版 Touhou 9.5：东方文花帖 1.02a 原可执行文件重建源码；只有使用固定版本 Visual C++ .NET 2003 构建、并与单一经哈希核验的目标进行可复现字节比较后，才认定函数级一致。整个程序也能编译链接为可游玩的 Windows i386 可执行文件，而 README 将可玩性、函数匹配与整个可执行文件一致性列为相互独立的状态。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"dynamorio","name":"DynamoRIO","name_zh":"DynamoRIO 动态二进制插桩框架","url":"https://github.com/DynamoRIO/dynamorio","evidence_url":"https://github.com/DynamoRIO/dynamorio/blob/6d2165aa485ca91bf10faa64440cfadce850b0bc/README.md","description_en":"Runtime code manipulation system for building dynamic tools that observe or transform any part of an unmodified program while it runs. Its API and IA-32/AMD64/ARM/AArch64 instruction manipulation library allow arbitrary changes to application instructions, not only inserted callouts. The release package bundles tools including drcov for code coverage, drltrace for library-call tracing, drstrace for Windows system calls, drmemtrace instruction and memory traces and the drdisas disassembler. It is a framework for building instrumentation tools, distinct from Frida's scripting of live processes.","description_zh":"运行时代码操作系统，用于构建在未修改程序运行期间观察或变换其任意部分的动态工具。其 API 与 IA-32/AMD64/ARM/AArch64 指令操作库允许任意修改应用指令，而不仅限于插入回调。发布包附带 drcov 代码覆盖率、drltrace 库调用跟踪、drstrace Windows 系统调用跟踪、drmemtrace 指令与内存访问跟踪以及 drdisas 反汇编器等工具。它是用于构建插桩工具的框架，与 Frida 对运行中进程编写脚本的方式不同。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-18"},{"id":"lgwebos-menubar-remote-case","name":"LGwebOS-menubar: a native macOS remote for LG webOS TVs","name_zh":"LGwebOS-menubar：LG webOS 电视的原生 macOS 遥控器","url":"https://github.com/gabrielgreco1/TVmenubar-MacOS","evidence_url":"https://github.com/gabrielgreco1/TVmenubar-MacOS/blob/8482f36aaeb2e6577cf58bba12306ba3701c0fd2/README.md","description_en":"A native macOS menu-bar app that pairs with an LG webOS TV over its local encrypted WebSocket interface to launch apps, switch inputs, adjust volume and picture settings, send pointer input and cast selected media. The project credits the public Connect SDK for webOS protocol behavior and reuses PyWebOSTV’s registration manifest. Testing covers one TV on webOS 5.0.","description_zh":"一款原生 macOS 菜单栏应用，通过 LG webOS 电视在局域网内的加密 WebSocket 接口完成配对，可启动应用、切换输入源、调节音量和画面设置、发送指针输入并投放所选媒体。项目称 webOS 协议行为参考了公开的 Connect SDK，并沿用 PyWebOSTV 的注册清单。测试仅覆盖一台 webOS 5.0 电视。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-20"},{"id":"ps2recomp","name":"PS2Recomp","name_zh":"PS2Recomp PlayStation 2 静态重编译器","url":"https://github.com/ran-j/PS2Recomp","evidence_url":"https://github.com/ran-j/PS2Recomp/blob/eb8688b2fd191129f103a39543002c005b33409c/README.md","description_en":"Experimental static recompiler that translates MIPS R5900 code from PlayStation 2 ELF executables into C++ and links it with a bundled runtime. ps2xAnalyzer or a Ghidra export script produces a per-game TOML of functions, stubs, skips and instruction patches; ps2xRecomp emits a literal instruction-by-instruction translation; ps2xRuntime and ps2xIOP supply guest memory, syscall dispatch, IOP module execution with HLE fallbacks and partial, largely stubbed GS/VU hardware. Output is not decompiled source, and getting a game to run remains per-game porting work.","description_zh":"实验性的静态重编译器，将 PlayStation 2 ELF 可执行文件中的 MIPS R5900 代码转换为 C++，并与随附的运行时链接。ps2xAnalyzer 或 Ghidra 导出脚本为每款游戏生成包含函数、存根、跳过项和指令补丁的 TOML 配置；ps2xRecomp 输出逐条指令的直译代码；ps2xRuntime 与 ps2xIOP 提供客户机内存、系统调用分发、带 HLE 回退的 IOP 模块执行，以及仅部分实现、大多为存根的 GS/VU 硬件。输出不是反编译源码，让游戏真正运行仍需针对每款游戏进行移植。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"corsixth-engine-case","name":"CorsixTH: an open reimplementation of Theme Hospital","name_zh":"CorsixTH：Theme Hospital 的开源重新实现","url":"https://github.com/CorsixTH/CorsixTH","evidence_url":"https://github.com/CorsixTH/CorsixTH/blob/e5138ed8de906ccbf6692299b4375f9312df147e/README.md","description_en":"Reimplements the engine of Bullfrog’s 1997 Theme Hospital, with game logic in Lua and C++ for graphics, sound, movies and pathfinding, on top of the original game’s data files. The README reports that the full campaign can be completed, lists features that are still missing, and adds extensions such as high resolutions and a map editor. It recreates the game’s behaviour on original content rather than recovering Bullfrog source code.","description_zh":"重新实现 Bullfrog 1997 年游戏 Theme Hospital 的引擎：游戏逻辑以 Lua 编写，图形、声音、影片和寻路由 C++ 处理，并建立在原游戏数据文件之上。README 报告完整战役已可通关，列出仍缺失的功能，并加入高分辨率和地图编辑器等扩展。它在原内容上重现游戏行为，而不是恢复 Bullfrog 的源码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"openriseofnations-engine-case","name":"OpenRiseOfNations: a native macOS engine reimplementation","name_zh":"OpenRiseOfNations：原生 macOS 引擎重新实现","url":"https://github.com/ben-wright-1/OpenRiseOfNations","evidence_url":"https://github.com/ben-wright-1/OpenRiseOfNations/blob/2a0dfde8acdb7185c6087b10ef89b4f66731e5a0/README.md","description_en":"Reimplements the Rise of Nations: Extended Edition engine as a native macOS app with a Metal renderer, a deterministic simulation, a computer opponent and a compatible BigHugeScript compiler and virtual machine, loading art, maps, rules and scripts from the user’s own Windows installation. Subsystem specifications written from Ghidra study of the symbol-bearing executable, together with JavaScript reference tools, guided a C++17 implementation built with heavy Claude Code assistance. The alpha plays tutorials and scenarios, and its bit-exactness checks remain project-reported.","description_zh":"以原生 macOS 应用重新实现 Rise of Nations: Extended Edition 引擎，包含 Metal 渲染器、确定性模拟、电脑对手，以及兼容的 BigHugeScript 编译器与虚拟机；美术、地图、规则和脚本均从使用者自有的 Windows 版安装目录读取。项目依据对带调试符号的可执行文件进行 Ghidra 研究后撰写的子系统规范及 JavaScript 参考工具，在大量使用 Claude Code 的情况下编写 C++17 实现。该早期版本可游玩教程与场景，其逐位一致性检查仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"th04-reconstruction-case","name":"TH04: rebuilding Lotus Land Story’s four PC-98 programs from source","name_zh":"TH04：从源码重建东方幻想乡的四个 PC-98 程序","url":"https://github.com/N0zoM1z0/th04","evidence_url":"https://github.com/N0zoM1z0/th04/blob/11577b35392c706f3bd39ff1ea932c003e1eaa6b/README.md","description_en":"Reconstructs source for the Japanese PC-98 Touhou 4: Lotus Land Story and rebuilds all four DOS programs, MAIN.EXE, OP.EXE, MAINE.EXE and ZUN.COM, with a pinned Borland toolchain under Wine. Function acceptance against the original binaries is tracked separately from emulator replays that compare inputs, RNG, object pools and video with the original game. Complete-campaign, original-timing and byte-identity goals remain open.","description_zh":"为日版 PC-98 Touhou 4：东方幻想乡重建源码，并在 Wine 下用固定版本的 Borland 工具链重新构建全部四个 DOS 程序：MAIN.EXE、OP.EXE、MAINE.EXE 和 ZUN.COM。针对原二进制的函数认定，与在模拟器中对照原游戏比较输入、随机数、对象池和画面的回放分开记录。完整流程、原始时序与字节一致性目标仍未完成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"supermodel-real3d-pro1000-emulation-case","name":"Supermodel: initial Real3D Pro-1000 image-generator emulation","name_zh":"Supermodel：Real3D Pro-1000 图像生成器的初步模拟","url":"https://github.com/trzy/Supermodel","evidence_url":"https://github.com/trzy/Supermodel/blob/4f5d686bbdd4a58d50a9fe66971ae5396626f1a1/Src/Pro1000/Pro1000.cpp","description_en":"Adds emulation of Real3D’s Pro-1000, the SCSI-attached image generator from which Sega’s Model 3 graphics hardware derives, to the Supermodel arcade emulator. It boots user-supplied Pro-1000 firmware from the SDK disc, emulates the board’s interrupt, JTAG and UART hardware, and exposes the firmware’s built-in monitor on the console. Nothing renders yet, and SCSI host communication is unimplemented.","description_zh":"为 Supermodel 街机模拟器加入对 Real3D Pro-1000 的模拟。Pro-1000 是通过 SCSI 连接主机的图像生成器，世嘉 Model 3 的图形硬件即由其衍生。该实现可启动使用者自备的、来自 SDK 光盘的 Pro-1000 固件，模拟板上的中断、JTAG 与 UART 硬件，并在控制台中提供固件内置的监控程序。目前尚无任何画面输出，与 SCSI 主机的通信也尚未实现。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-10-18"},{"id":"blackbox-protobuf","name":"Blackbox Protobuf","name_zh":"Blackbox Protobuf 无定义 Protobuf 解码与重编码工具","url":"https://github.com/nccgroup/blackboxprotobuf","evidence_url":"https://github.com/nccgroup/blackboxprotobuf/blob/b98861e0f732e902923abc36cc08c40917f34127/README.md","description_en":"NCC Group's tools for decoding and re-encoding Protocol Buffers messages without the matching .proto definition. The decoder returns the message data with an editable type definition built from best-effort guesses based on wire types; analysts can name fields, correct types and re-encode edited messages, which protoc --decode_raw cannot do. It ships as a Python library with a bbpb CLI, a Jython Burp Suite extension and a mitmproxy addon, and its README traces it to modifying messages during mobile penetration tests.","description_zh":"NCC Group 推出的工具集，可在没有对应 .proto 定义的情况下解码并重新编码 Protocol Buffers 报文。解码器返回报文数据，以及根据线路类型尽力推测生成、可编辑的类型定义；分析者可以为字段命名、修正类型并重新编码修改后的报文，这是 protoc --decode_raw 做不到的。它提供 Python 库及 bbpb 命令行工具、基于 Jython 的 Burp Suite 扩展和 mitmproxy 插件，README 说明它最初用于在移动应用渗透测试中修改报文。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"claude-intercept-traffic-capture","name":"Claude Intercept","name_zh":"Claude Intercept 流量捕获分析工具","url":"https://github.com/whaesemeyer/claude-intercept","evidence_url":"https://github.com/whaesemeyer/claude-intercept/blob/c2b7d01911e11e063533dbd61a22b404b503b48d/README.md","description_en":"A local man-in-the-middle proxy and dashboard that captures HTTP/S traffic from the user’s own computer and devices, stores it in SQLite and hands it to Claude Code through an /intercept skill and CLI. Exports such as API documentation and traffic summaries support investigating request patterns and undocumented endpoints. It is an agent-facing capture tool for authorized testing, not a reconstruction case, and it has no established REA connection.","description_zh":"本地中间人代理与控制面板，捕获使用者自有电脑和设备的 HTTP/S 流量，存入 SQLite，并通过 /intercept 技能和命令行交给 Claude Code。API 文档、流量摘要等导出模式可用于调查请求模式与未公开接口。这是面向智能体、用于授权测试的抓包工具，不是重建案例，也未确立与 REA 的关联。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"finding-jingle-town-n64-debugging","name":"Finding Jingle Town: Debugging an N64 Game without Symbols","name_zh":"寻找 Jingle Town：在没有调试符号时调试 N64 游戏","url":"https://blog.chrislewis.au/finding-jingle-town-debugging-an-n64-game-without-symbols/","evidence_url":"https://blog.chrislewis.au/finding-jingle-town-debugging-an-n64-game-without-symbols/","description_en":"A walkthrough from the Snowboard Kids 2 decompilation project on attaching gdb-multiarch to the Ares emulator while the matching build still cannot carry debug information. It breaks on a function by its ELF symbol name and reads one structure byte by hand to test whether that byte selects the level overlay. A short method note on checking decompilation hypotheses at runtime, not a reconstruction result.","description_zh":"Snowboard Kids 2 反编译项目的一篇操作说明：在一致性构建仍无法加入调试信息时，把 gdb-multiarch 接到 Ares 模拟器上。文中按 ELF 符号名在函数处设断点，再手动读取结构体中的一个字节，检验它是否决定加载哪个关卡 overlay。这是在运行时检验反编译假设的简短方法记录，而非重建成果。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["game"],"verified_at":"2026-10-18"},{"id":"jpcert-apk-api-attack-infrastructure-report","name":"JPCERT/CC: APK analysis and API probing on attack servers","name_zh":"JPCERT/CC：攻击服务器上的 APK 解析与 API 探测","url":"https://blogs.jpcert.or.jp/ja/2026/10/web_api_attacks.html","evidence_url":"https://blogs.jpcert.or.jp/ja/2026/10/web_api_attacks.html","description_en":"JPCERT/CC’s 15 October 2026 blog post on the infrastructure behind a series of unauthorized-access incidents in Japan. It reports that the attackers used AI for known-vulnerability scanning and API attacks, and that attack servers held APKs, jadx- and Blutter-related files, APK-extraction directories and an SSRF test script used to probe app APIs. It is a defender’s account of observed attacker tooling with mitigation advice, not a published AI-assisted analysis method or reproducible workflow.","description_zh":"JPCERT/CC 于 2026 年 10 月 15 日发布的博客文章，调查日本国内一系列不正当访问事件背后的攻击基础设施。文章报告攻击者利用 AI 扫描已知漏洞并经由 API 发动攻击，攻击服务器上存有 APK 文件、与 jadx 和 Blutter 相关的文件、APK 解包目录，以及用于探测应用 API 的 SSRF 验证脚本。这是防御方对所观察到的攻击者工具的记述并附缓解建议，而非公开的 AI 辅助分析方法或可复现的工作流程。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app"],"verified_at":"2026-10-18"},{"id":"decomp-compat-kit","name":"Xenosaga I Decomp Compatibility Kit","name_zh":"Xenosaga I 反编译兼容性工具包","url":"https://github.com/LinuxJessi/decomp-compat-kit","evidence_url":"https://github.com/LinuxJessi/decomp-compat-kit/blob/d9bb53dac364ecfaff4f8b00ea44baec60a27abf/README.md","description_en":"Checks a PS2 matching decompilation from outside its own build: the C is recompiled with a stock, unpatched ee-gcc 2.96 and assembler, then each function is byte-compared against the original and every difference is classified by its likely toolchain cause. Companion scripts export ELF symbol tables to CSV and convert them to splat symbol files. Defaults target Xenosaga Episode I; the README says the method generalises but the defaults do not.","description_zh":"在匹配反编译项目自身的构建之外进行检查：用未打补丁的原版 ee-gcc 2.96 及汇编器重新编译其 C 代码，再逐函数与原程序逐字节比较，并按可能的工具链原因对每处差异分类。配套脚本可将 ELF 符号表导出为 CSV，并转换为 splat 符号文件。默认配置针对 Xenosaga Episode I；README 称方法可推广，默认配置则不能。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"infamous-second-son-pc-port-case","name":"inFAMOUS Second Son native PC port","name_zh":"《声名狼藉：次子》原生 PC 移植","url":"https://github.com/HayatoG/iss_pc","evidence_url":"https://github.com/HayatoG/iss_pc/blob/d3995feb0cea1e2edc0c71fab139d1e89f0a7305/README.md","description_en":"Runs the PS4 inFAMOUS Second Son’s own x86-64 code natively on Windows and Linux: a runtime reimplements the PS4 system libraries the game uses, and a shadPS4-derived core translates its GPU commands and shaders to Vulkan. The project reports a playable, in-development port that reaches gameplay and the first chapters, with unstable performance and remaining graphics glitches. It is a compatibility-runtime port rather than a decompilation, and its results remain project-reported.","description_zh":"在 Windows 与 Linux 上原生运行 PS4 版《声名狼藉：次子》自身的 x86-64 代码：由运行时重新实现游戏所用的 PS4 系统库，并以源自 shadPS4 的核心将其 GPU 命令与着色器转换为 Vulkan。项目报告该移植可以游玩但仍在开发中，能进入游戏并通过最初几章，性能仍不稳定，也有尚未解决的图形问题。这是兼容运行时移植而非反编译重建，结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"xoreos-aurora-engine-case","name":"xoreos: an open reimplementation of BioWare’s Aurora engine family","name_zh":"xoreos：BioWare Aurora 引擎家族的开源重新实现","url":"https://github.com/xoreos/xoreos","evidence_url":"https://github.com/xoreos/xoreos/blob/6774724d5c05e09ce0d01e00b8b62f956ddcb74b/README.md","description_en":"Reimplements BioWare’s Aurora engine and its later derivatives as a portable C++ engine that runs on the user’s installed game data, targeting nine games from Neverwinter Nights to Dragon Age II. Resource management, many Aurora file formats, graphics and sound are in place, and every target shows partial in-game areas in a free-flying spectator mode. README states that normal gameplay is not implemented yet, so this is an early-stage engine case, not a playable replacement.","description_zh":"以可移植的 C++ 引擎重新实现 BioWare 的 Aurora 引擎及其后续衍生版本，在使用者已安装的游戏数据上运行，目标涵盖从《无冬之夜》到《龙腾世纪 II》的九款游戏。资源管理、大量 Aurora 文件格式、图形和声音均已实现，所有目标游戏都能在可自由飞行的旁观模式下显示部分游戏内场景。README 说明尚未实现正常的游戏流程，因此这是一个早期阶段的引擎案例，而非可以替代原版游玩的实现。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"ghidra-mcp-bethington","name":"Ghidra MCP Server (bethington)","name_zh":"Ghidra MCP Server（bethington）","url":"https://github.com/bethington/ghidra-mcp","evidence_url":"https://github.com/bethington/ghidra-mcp/blob/cf8b12db27eb139b28b90eaa3488306da910d759/README.md","description_en":"A Ghidra GUI plugin, standalone headless server and Python MCP bridge exposing a 209-tool catalog: decompilation, cross-references, renaming, typing, structures, comments and batch edits, plus P-code emulation, live debugging through Ghidra’s TraceRmi framework, shared Ghidra Server repository and version-control operations, and hash-based transfer of function documentation between binary versions. The bridge loads three tool groups on connect and lets the model search for and load the rest, while naming and type conventions are enforced in the tool layer. Its NOTICE says it began as a derivative of LaurieWired’s GhidraMCP in August 2025 and has since been substantially rewritten and extended.","description_zh":"由 Ghidra 图形界面插件、独立无界面服务器和 Python MCP 桥接组成，提供含 209 个工具的目录：反编译、交叉引用、重命名、类型设定、结构体、注释与批量编辑，另有 P-code 模拟执行、经 Ghidra TraceRmi 框架的实时调试、共享 Ghidra Server 仓库与版本控制操作，以及基于哈希在不同版本二进制之间迁移函数文档。桥接在连接时只加载三组工具，其余由模型按需搜索并加载；命名与类型规范在工具层强制执行。其 NOTICE 说明，项目于 2025 年 8 月由 LaurieWired 的 GhidraMCP 衍生而来，此后已大幅重写和扩展。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"librw-renderware-reimplementation-case","name":"librw: a re-implementation of the RenderWare Graphics engine","name_zh":"librw：RenderWare Graphics 引擎的重新实现","url":"https://github.com/aap/librw","evidence_url":"https://github.com/aap/librw/blob/18532c2e13efbc1aa43f0b00b4459831f9414de0/README.md","description_en":"Re-implements a large part of the RenderWare Graphics middleware API as a portable C++ library that reads and writes its DFF model and TXD texture files for PS2, D3D8, D3D9 and Xbox and is meant to convert them between platforms. Direct3D 9 and OpenGL backends render the scenes, while PS2 rendering works only as a test. README names rendering GTA as its use; BSP world files are not supported.","description_zh":"以可移植的 C++ 库重新实现 RenderWare Graphics 中间件 API 的大部分内容，可读写其 PS2、D3D8、D3D9 和 Xbox 平台的 DFF 模型与 TXD 纹理文件，并旨在于各平台格式之间转换。场景由 Direct3D 9 和 OpenGL 后端渲染，PS2 渲染仅作为测试可用。README 称其用途是渲染 GTA 游戏；BSP 世界文件尚不支持。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"awesome-game-decompilations","name":"awesome-game-decompilations","name_zh":"awesome-game-decompilations 游戏反编译项目清单","url":"https://github.com/CharlotteCross1998/awesome-game-decompilations","evidence_url":"https://github.com/CharlotteCross1998/awesome-game-decompilations/blob/31e56f7894761ab48f05b8a1e71770a91cf2ce67/README.md","description_en":"A single-README list of about 480 game decompilation, recompilation and disassembly projects, grouped by console from the NES and Game Boy to the Xbox 360, PC and mobile, with a large uncategorised section. Each entry is a game title linked to its project, mostly on GitHub, and entries with AI involvement are marked with a warning emoji under the maintainer’s disclosure policy.","description_zh":"以单个 README 维护的游戏反编译、重编译和反汇编项目清单，约 480 项，按主机平台分组，从 NES、Game Boy 到 Xbox 360、PC 和移动平台，另有规模较大的未分类部分。每个条目是链接到对应项目的游戏名，大多指向 GitHub；按维护者的披露政策，有 AI 参与的条目以警告符号标出。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["game"],"verified_at":"2026-10-19"},{"id":"vineflower","name":"Vineflower","name_zh":"Vineflower Java 反编译器","url":"https://github.com/Vineflower/vineflower","evidence_url":"https://github.com/Vineflower/vineflower/blob/b8273988af850e8cfb234ca08d129058502b032f/README.md","description_en":"Fernflower-derived decompiler for Java and other JVM languages that continues the ForgeFlower, Fabric and Quiltflower forks, focused on output quality and modern Java, including records, sealed classes, switch expressions and pattern matching through Java 21+. Its command line takes a JAR, ZIP, folder or class file and writes a folder, an archive or console output, with multithreaded decompilation and automatic formatting. It can also be embedded as a library from Maven Central or used in IntelliJ IDEA through a plugin that replaces Fernflower, and the regular release JAR bundles three plugins, including Kotlin support and variable renaming.","description_zh":"源自 Fernflower 的 Java 及其他 JVM 语言反编译器，延续了 ForgeFlower、Fabric 和 Quiltflower 等分支的工作，注重输出质量和对现代 Java 的支持，包括 Java 21+ 的记录、密封类、switch 表达式和模式匹配。其命令行接受 JAR、ZIP、文件夹或 class 文件，可输出到文件夹、归档或控制台，支持多线程反编译和自动格式化。它也可作为 Maven Central 上的库嵌入使用，或通过替换 Fernflower 的插件在 IntelliJ IDEA 中使用；常规发布 JAR 内置三个插件，包括 Kotlin 支持和变量重命名。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"pycdc","name":"Decompyle++ (pycdc)","name_zh":"Decompyle++（pycdc）Python 字节码反编译器","url":"https://github.com/zrax/pycdc","evidence_url":"https://github.com/zrax/pycdc/blob/b4289760970dbc399684f1e155ec6d1ea1cc787e/README.markdown","description_en":"C++ disassembler and decompiler for compiled Python bytecode that aims to support bytecode from any Python version. pycdas prints the disassembly of a .pyc file, and pycdc prints reconstructed Python source to stdout with errors on stderr; both also accept raw marshalled code objects when the Python version is given on the command line. The source carries opcode tables for Python 1.0 through 3.13.","description_zh":"用 C++ 编写的 Python 字节码反汇编器与反编译器，目标是支持任意 Python 版本的字节码。pycdas 输出 .pyc 文件的反汇编结果，pycdc 则把重建出的 Python 源码输出到标准输出，错误信息输出到标准错误；在命令行中指定 Python 版本后，两者也能处理原始的 marshal 代码对象。源码中包含 Python 1.0 至 3.13 的操作码表。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"odyssey-decomp-case","name":"Super Mario Odyssey: per-function matching decompilation of the Switch executable","name_zh":"《超级马力欧 奥德赛》：Switch 主程序的逐函数一致性反编译","url":"https://github.com/MonsterDruide1/OdysseyDecomp","evidence_url":"https://github.com/MonsterDruide1/OdysseyDecomp/blob/696db2ff5ed558b053c753de420504b8682f24b0/README.md","description_en":"Reconstructs C++ source for Super Mario Odyssey’s Switch 1.0 main executable and checks each function against the original AArch64 machine code with the shared nx-decomp-tools checker. At the pinned commit its function list marks 18,996 of 74,171 functions matching. The README warns that the build is not a playable game, the repository ships no game assets, and Nintendo libraries such as sead and agl come from open-ead’s separate reconstructions.","description_zh":"为《超级马力欧 奥德赛》Switch 1.0 版主程序重建 C++ 源码，并用共享的 nx-decomp-tools 检查器逐个函数与原始 AArch64 机器码比对。在所审固定提交中，其函数清单将 74,171 个函数中的 18,996 个标为一致。README 提醒构建结果不是可游玩的游戏；仓库不含游戏素材，sead、agl 等任天堂库则来自 open-ead 另行维护的重建项目。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"droid-asc","name":"Droid ASC","name_zh":"Droid ASC Android 反编译器","url":"https://github.com/MG1937/ASC","evidence_url":"https://github.com/MG1937/ASC/blob/60033d1c76bc5904588f24955cae4e83a2ba4f5d/README.md","description_en":"Python Android decompiler that answers queries directly against an APK instead of first unpacking and indexing it. It probes compressed DEX entries in place, uses the layout that the R8 compiler’s constant relocation and instruction deduplication leave behind to search string, type, method and field references across DEX files, and for a requested class rebuilds a minimal, self-consistent DEX in memory that a bundled copy of Androguard’s decompiler turns into Java. The droidasc CLI and Tk GUI list classes, decompile single classes, decode AndroidManifest.xml and find subclasses or interface implementations; the README presents it as a lightweight back end for agents analyzing many APKs.","description_zh":"用 Python 编写的 Android 反编译器，直接对 APK 执行查询，而不必先解包并建立索引。它在压缩的 DEX 条目中就地探测数据，利用 R8 编译器的常量重定位和指令去重所留下的布局，跨 DEX 文件搜索字符串、类型、方法和字段引用；对指定的类，则在内存中重建一个最小且自洽的 DEX，再由内置的 Androguard 反编译器副本转换为 Java 代码。droidasc 命令行和 Tk 图形界面可列出类、反编译单个类、解码 AndroidManifest.xml，并查找子类或接口实现；README 将其定位为供智能体批量分析 APK 的轻量后端。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"apkeditor","name":"APKEditor","name_zh":"APKEditor","url":"https://github.com/REAndroid/APKEditor","evidence_url":"https://github.com/REAndroid/APKEditor/blob/5621fe6750b828ce0bfd99ec7f42ee8b5fe75497/README.md","description_en":"Command-line APK editor built on ARSCLib that decodes an APK's binary resources and DEX into editable JSON, XML or smali and rebuilds a package from them, independent of aapt and aapt2. It also merges split bundles such as XAPK, APKM and APKS, refactors obfuscated resource names, and prints package information.","description_zh":"基于 ARSCLib 的命令行 APK 编辑器，不依赖 aapt 与 aapt2，可将 APK 的二进制资源与 DEX 解码为可编辑的 JSON、XML 或 smali 并重新构建安装包。还能合并 XAPK、APKM、APKS 等分包，还原被混淆的资源名称，并打印包信息。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"avatar2","name":"avatar²","name_zh":"avatar² 多目标固件动态分析编排框架","url":"https://github.com/avatartwo/avatar2","evidence_url":"https://github.com/avatartwo/avatar2/blob/56a90cfe738886236dcbc3653756bdbdec6aaf92/README.md","description_en":"Python framework from EURECOM's S3 group that orchestrates emulators, debuggers and physical devices for dynamic analysis of embedded firmware. An analysis script declares targets, such as a modified QEMU, PANDA, Unicorn, a gdbserver or an OpenOCD or J-Link debug probe, then a memory layout whose ranges can forward accesses from one target to another, and an execution plan. Execution and register or memory state can move between targets, so firmware can run in an emulator while its peripheral accesses go to the real device.","description_zh":"由 EURECOM S3 小组开发的 Python 框架，可协调模拟器、调试器和物理设备，对嵌入式固件进行动态分析。分析脚本先声明目标（如修改版 QEMU、PANDA、Unicorn、gdbserver，或 OpenOCD、J-Link 调试探针），再定义内存布局（其中的内存区间可把访问从一个目标转发到另一个目标）和执行计划。执行过程以及寄存器、内存状态可在目标之间转移，从而让固件在模拟器中运行，同时把外设访问转发给真实设备。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"cwe-checker","name":"cwe_checker","name_zh":"cwe_checker 二进制漏洞模式检查工具","url":"https://github.com/fkie-cad/cwe_checker","evidence_url":"https://github.com/fkie-cad/cwe_checker/blob/7288311bbf9d2d1111434f8c07617ce580b9c8c0/README.md","description_en":"Static analyzer from Fraunhofer FKIE that searches binary executables, mainly Linux and Unix ELF files, for code paths matching Common Weakness Enumeration bug classes such as buffer overflows, use-after-free and double free, NULL pointer dereferences, format strings and integer overflows. Ghidra disassembles the binary into a common intermediate representation on which its checks run, from simple heuristics to abstract-interpretation data-flow analysis, so it covers the CPU architectures Ghidra supports, including x86, ARM, MIPS and PowerPC. Warnings are printed as text or JSON, and a bundled Ghidra script annotates them in the disassembly for manual review.","description_zh":"Fraunhofer FKIE 开发的静态分析工具，在二进制可执行文件（主要是 Linux 和 Unix 的 ELF 文件）中查找符合通用缺陷枚举（CWE）漏洞类别的代码路径，例如缓冲区溢出、释放后使用与重复释放、空指针解引用、格式化字符串和整数溢出。它先由 Ghidra 把二进制反汇编为统一的中间表示，再在其上运行从简单启发式到基于抽象解释的数据流分析等各类检查，因此适用于 Ghidra 支持的 CPU 架构，包括 x86、ARM、MIPS 和 PowerPC。告警以文本或 JSON 输出，随附的 Ghidra 脚本可把告警标注在反汇编中，便于人工复核。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"jnitrace","name":"jnitrace","name_zh":"jnitrace","url":"https://github.com/chame1eon/jnitrace","evidence_url":"https://github.com/chame1eon/jnitrace/blob/5be47cb52b448bb0f39153d6c2c71b6744ad982a/README.md","description_en":"Frida-based dynamic-analysis tool that traces an Android app's use of the JNI API, similar to frida-trace or strace but for the Java Native Interface. It logs the JNI calls that native libraries make through the JNIEnv and JavaVM structures, with include and exclude filters, backtraces and optional JSON output for later post-processing. The tracing engine is also published as a separate jnitrace-engine library.","description_zh":"基于 Frida 的动态分析工具，用于跟踪 Android 应用对 JNI API 的调用，类似 frida-trace 或 strace，但面向 Java 本地接口。它记录原生库通过 JNIEnv 与 JavaVM 结构发起的 JNI 调用，支持包含/排除过滤、回溯以及可选的 JSON 输出以便后续处理。其跟踪引擎另以 jnitrace-engine 库形式单独发布。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"flare-vm","name":"FLARE-VM","name_zh":"FLARE-VM 恶意软件分析虚拟机安装工具","url":"https://github.com/mandiant/flare-vm","evidence_url":"https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/README.md","description_en":"Mandiant FLARE installer that sets up and maintains a Windows virtual machine for reverse engineering and malware analysis. Its PowerShell script uses Boxstarter and Chocolatey to install packages from the separate VM-Packages feed and the Chocolatey community feed, chosen in a GUI or a custom config.xml that also sets environment paths, the taskbar layout and post-install registry, service and path settings. The reviewed default configuration lists 137 packages, among them Ghidra, IDA Free, x64dbg, dnSpyEx, capa, FLOSS, PE-sieve, FakeNet-NG and Wireshark; scripts in its virtualbox folder build, snapshot and export FLARE-VM and REMnux VMs in VirtualBox.","description_zh":"Mandiant FLARE 团队的安装脚本，用于搭建并维护一台面向逆向工程和恶意软件分析的 Windows 虚拟机。其 PowerShell 脚本借助 Boxstarter 和 Chocolatey，从独立的 VM-Packages 软件源和 Chocolatey 社区源安装软件包；软件包可在图形界面中选择，也可通过自定义 config.xml 指定，该文件还可设置环境变量路径、任务栏布局以及安装后的注册表、服务和路径设置。所审阅的默认配置列出 137 个软件包，包括 Ghidra、IDA Free、x64dbg、dnSpyEx、capa、FLOSS、PE-sieve、FakeNet-NG 和 Wireshark；virtualbox 目录中的脚本可在 VirtualBox 中构建 FLARE-VM 和 REMnux 虚拟机，并管理和导出其快照。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"b2r2","name":"B2R2","name_zh":"B2R2 二进制分析框架","url":"https://github.com/B2R2-org/B2R2","evidence_url":"https://github.com/B2R2-org/B2R2/blob/37de7a7274b61f7ec679153740955e7f9a94221e/README.md","description_en":"Binary analysis framework written in F# for .NET by KAIST's SoftSec Lab. It parses ELF, PE, Mach-O and WebAssembly files, parses, disassembles and lifts instructions into its own IR, recovers control-flow graphs and assembles code; the README's feature table covers x86/x86-64, ARMv7/AArch64, MIPS, PowerPC, RISC-V, SPARC, S390 and other ISAs as well as CIL, EVM, eBPF, WebAssembly and Python bytecode. Its b2r2 launcher starts a readelf-like format scanner, a linear-sweep disassembler, a recursive-descent explorer with a web GUI, an IR and assembly REPL and an assembler.","description_zh":"KAIST SoftSec 实验室开发的二进制分析框架，以 F# 编写、运行于 .NET。它可解析 ELF、PE、Mach-O 和 WebAssembly 文件，对指令进行解析、反汇编并提升为自有中间表示，还能恢复控制流图和汇编代码；README 的功能表涵盖 x86/x86-64、ARMv7/AArch64、MIPS、PowerPC、RISC-V、SPARC、S390 等指令集，以及 CIL、EVM、eBPF、WebAssembly 和 Python 字节码。其 b2r2 启动器可调用类似 readelf 的格式扫描器、线性扫描反汇编器、带 Web 图形界面的递归下降式探索工具、面向 IR 与汇编的 REPL 以及汇编器。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"rz-ghidra","name":"rz-ghidra","name_zh":"rz-ghidra Rizin 的 Ghidra 反编译器插件","url":"https://github.com/rizinorg/rz-ghidra","evidence_url":"https://github.com/rizinorg/rz-ghidra/blob/0f4e062aca031f63bd97ffcb49ca289049ec2e9d/README.md","description_en":"Rizin plugin that embeds Ghidra's C++ decompiler and Sleigh disassembler, so no Java Ghidra installation is needed. Its pdg commands decompile the current function, optionally side by side with offsets or as XML or JSON, can return the output to Rizin as comments, and list the loaded Sleigh languages; config variables control formatting and can override the auto-detected Sleigh language. The decompiler draws on Rizin's loaded binary, types and comments, and an optional plugin brings it into the Cutter GUI.","description_zh":"Rizin 插件，内嵌 Ghidra 的 C++ 反编译器和 Sleigh 反汇编器，因此无需安装 Java 版 Ghidra。其 pdg 系列命令可反编译当前函数，也可与偏移量并排显示或以 XML、JSON 格式输出，还能把结果作为注释写回 Rizin，并列出已加载的 Sleigh 语言；配置变量可调整输出格式，也可覆盖自动检测到的 Sleigh 语言。反编译器使用 Rizin 已加载的二进制、类型和注释；另有可选插件将其接入 Cutter 图形界面。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"asmresolver","name":"AsmResolver","name_zh":"AsmResolver PE 与 .NET 模块编辑库","url":"https://github.com/Washi1337/AsmResolver","evidence_url":"https://github.com/Washi1337/AsmResolver/blob/0715000c1b3a5104531d5ff189a14ebef0a9d5ac/README.md","description_en":"C# library for reading, modifying and rebuilding Portable Executable files, covering both native Windows images and images with .NET metadata. It offers three levels of abstraction: raw headers and sections (PEFile); interpreted data directories such as imports, exports, TLS, exceptions, debug data and Win32 resources (PEImage); and a System.Reflection-like model of .NET assemblies and modules with managed, native and dynamic method bodies. It also extracts files from AppHost/single-file bundles, supports ReadyToRun images and reads PDB and Portable PDB symbols without DIA, and upstream designs it to stay robust against malformed or obfuscated binaries.","description_zh":"用于读取、修改和重建 PE（可移植可执行）文件的 C# 库，既支持 Windows 原生映像，也支持带 .NET 元数据的映像。它提供三个抽象层次：原始文件头和节区（PEFile）；导入、导出、TLS、异常、调试信息和 Win32 资源等数据目录的解析结果（PEImage）；以及类似 System.Reflection 的 .NET 程序集和模块模型，涵盖托管、原生和动态方法体。它还能从 AppHost／单文件捆绑包中提取文件，支持 ReadyToRun 映像，无需 DIA 即可读取 PDB 和 Portable PDB 符号；上游的设计目标是在面对格式异常或经过混淆的二进制时保持稳健。","kind":"tool","category":"dotnet","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"decompilerserver-dotnet-mcp","name":"DecompilerServer","name_zh":"DecompilerServer .NET 反编译 MCP 服务器","url":"https://github.com/pardeike/DecompilerServer","evidence_url":"https://github.com/pardeike/DecompilerServer/blob/42c3f9106c20e5597cd11bcab70c5937d101f03e/README.md","description_en":"Stdio MCP server built on the ICSharpCode.Decompiler engine that lets agents load managed .NET assemblies, including a Unity game's Assembly-CSharp.dll located from its game directory, then search symbols, string literals and attributes, read decompiled C# or IL, and trace callers, callees, usages and inheritance. Several assemblies stay loaded under aliases, so an agent can compare two versions structurally or diff individual method bodies, the README's example being RimWorld mod porting. Modding-oriented tools generate Harmony patch skeletons, detour stubs and transpiler anchor suggestions as text from the inspected members.","description_zh":"基于 ICSharpCode.Decompiler 引擎的 stdio MCP 服务器，智能体可借此加载托管 .NET 程序集（包括从游戏目录中定位到的 Unity 游戏 Assembly-CSharp.dll），继而搜索符号、字符串字面量和特性，阅读反编译得到的 C# 或 IL，并追踪调用方、被调用方、使用位置和继承关系。多个程序集可以用别名同时保持加载，便于智能体对两个版本做结构比较或逐个比对方法体，README 举的例子是 RimWorld 模组移植。面向模组开发的工具还能根据所查看的成员，以文本形式生成 Harmony 补丁骨架、绕行存根和 Transpiler 锚点建议。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app","game"],"verified_at":"2026-10-19"},{"id":"gepetto","name":"Gepetto","name_zh":"Gepetto：调用大模型辅助逆向的 IDA 插件","url":"https://github.com/JusticeRage/Gepetto","evidence_url":"https://github.com/JusticeRage/Gepetto/blob/f98e4c12decf86eae76ece9d6955bb6dfe472190/README.md","description_en":"IDA Pro plugin that sends Hex-Rays pseudocode to a hosted or local language model the user selects, to explain a function, comment it or propose new variable and function names, which the user picks from before they are applied. A chat console inside IDA also lets the model call tools that read disassembly, decompilation, cross-references, strings and types, rename and comment the database and run Python. The README warns that these general-purpose models may well be wrong and asks users to treat every result critically.","description_zh":"IDA Pro 插件，把 Hex-Rays 伪代码发送给使用者选定的托管或本地大模型，用于解释函数、添加注释或提出新的变量名与函数名，由使用者勾选后再应用。IDA 内的对话控制台还允许模型调用工具，读取反汇编、反编译结果、交叉引用、字符串和类型，对数据库进行重命名和注释，并运行 Python。README 提醒这些通用模型很可能出错，要求使用者审慎对待每一个结果。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"ghidrassistmcp","name":"GhidrAssistMCP","name_zh":"GhidrAssistMCP Ghidra 原生 MCP 扩展","url":"https://github.com/symgraph/GhidrAssistMCP","evidence_url":"https://github.com/symgraph/GhidrAssistMCP/blob/b575acc1412cafcfd4dc9fedb7f99ecf219c68ab/README.md","description_en":"Ghidra extension that runs an MCP server inside Ghidra over streamable HTTP and legacy SSE, with 100 explicitly named tools (93 enabled by default) for pseudocode, disassembly, P-code, control-flow and call graphs, cross-references, strings, imports and exports, plus renaming, retyping, comments and structure inference. Since version 3.0.0 the server starts with the project manager, so agents can create, open, save and close projects and open programs before a CodeBrowser exists, while one shared server tracks whichever CodeBrowser window has focus. Six program resource templates, seven analysis prompts and a bundled script for running the server under analyzeHeadless complete the package.","description_zh":"在 Ghidra 内运行 MCP 服务器的 Ghidra 扩展，通过 streamable HTTP 和旧版 SSE 提供 100 个名称明确的工具（默认启用 93 个），涵盖伪代码、反汇编、P-code、控制流图与调用图、交叉引用、字符串、导入表和导出表，以及重命名、修改类型、注释和结构体推断。自 3.0.0 版起，服务器随项目管理器一同启动，智能体在 CodeBrowser 尚未打开时即可创建、打开、保存和关闭项目并打开程序；同一个共享服务器会跟踪当前获得焦点的 CodeBrowser 窗口。扩展另附六个程序资源模板、七个分析提示词，以及在 analyzeHeadless 下运行服务器的脚本。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"dewolf","name":"dewolf","name_zh":"dewolf 研究型反编译器","url":"https://github.com/fkie-cad/dewolf","evidence_url":"https://github.com/fkie-cad/dewolf/blob/3c389e18f03cd922f4b424a62d3717dac6fe3eee/README.md","description_en":"Research decompiler from Fraunhofer FKIE, developed with Singapore's DSO National Laboratories between 2019 and 2021, that runs as a Binary Ninja plugin and starts from Binary Ninja's Medium Level IL. A pipeline of preprocessing, SSA, data-flow and control-flow stages restructures code following the DREAM/DREAM++ approach and emits C-like output. Results appear in a Binary Ninja dock widget, or decompile.py prints or writes them for a whole binary or one named function in batch use.","description_zh":"由 Fraunhofer FKIE 与新加坡 DSO 国家实验室在 2019 至 2021 年合作研发的研究型反编译器，以 Binary Ninja 插件形式运行，并以 Binary Ninja 的中级中间语言（Medium Level IL）为起点。它通过预处理、SSA、数据流和控制流等阶段组成的流水线，按照 DREAM/DREAM++ 方法重建控制结构，输出类 C 代码。结果可在 Binary Ninja 的停靠窗口中查看，也可在批量场景下用 decompile.py 对整个二进制或指定函数进行反编译，并输出到终端或文件。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"dembrandt","name":"Dembrandt","name_zh":"Dembrandt 网站设计系统提取工具","url":"https://github.com/dembrandt/dembrandt","evidence_url":"https://github.com/dembrandt/dembrandt/blob/4deb8350b134669dc0251af56e028a7250d86914/README.md","description_en":"Node.js CLI that renders a website in Playwright-driven Chromium or Firefox and reads computed styles from the DOM to extract its design system: logo, color roles with the evidence behind each pick, typography, spacing, borders, shadows, motion, breakpoints and component styles such as buttons and inputs. Results export as W3C design tokens (DTCG), Tailwind v4 or shadcn/ui themes, DESIGN.md, an HTML report or a brand-guide PDF, alongside WCAG contrast checks on real DOM pairs and a CI drift gate against a committed baseline. It also runs as an MCP server for agent clients.","description_zh":"Node.js 命令行工具，通过 Playwright 驱动 Chromium 或 Firefox 渲染网站，并从 DOM 读取计算样式来提取其设计系统：标志、附带判定依据的颜色角色、字体排版、间距、边框、阴影、动效、断点，以及按钮、输入框等组件样式。结果可导出为 W3C 设计令牌（DTCG）、Tailwind v4 或 shadcn/ui 主题、DESIGN.md、HTML 报告或品牌指南 PDF，还能对页面中实际的前景与背景组合做 WCAG 对比度检查，并在 CI 中与已提交的基线比较、拦截设计漂移。它也能作为 MCP 服务器供智能体客户端调用。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"android-reverse-engineering-skill","name":"Android Reverse Engineering Skill","name_zh":"Android Reverse Engineering Skill 安卓反编译智能体技能","url":"https://github.com/SimoneAvogadro/android-reverse-engineering-skill","evidence_url":"https://github.com/SimoneAvogadro/android-reverse-engineering-skill/blob/0c7cf89830993df7dfc178498f69952262808bea/README.md","description_en":"Claude Code plugin and agent skill that drives jadx and Fernflower/Vineflower to decompile Android APK, XAPK, JAR and AAR files and document their HTTP APIs. A fingerprint pass first identifies the app's framework, HTTP stack, obfuscation level and native libraries, then shell scripts extract endpoints and authentication patterns across Retrofit, OkHttp, Volley, Ktor and Apollo/GraphQL, trace call flows from UI down to the network layer, and rebuild original Kotlin class names from the metadata R8 leaves behind. It installs through the bundled Claude Code marketplace, and its scripts also run standalone with a /decompile slash command.","description_zh":"Claude Code 插件及智能体技能，驱动 jadx 与 Fernflower/Vineflower 反编译 Android 的 APK、XAPK、JAR 和 AAR 文件并记录其 HTTP 接口。它先用指纹步骤识别应用的框架、HTTP 栈、混淆程度和原生库，再通过 shell 脚本在 Retrofit、OkHttp、Volley、Ktor 和 Apollo/GraphQL 等栈中提取接口与鉴权特征，追踪从界面到网络层的调用链，并利用 R8 无法剥除的元数据还原原始的 Kotlin 类名。技能通过自带的 Claude Code marketplace 安装，其脚本也可独立运行，并提供 /decompile 斜杠命令。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["app"],"verified_at":"2026-10-19"},{"id":"gb-recompiled","name":"GB Recompiled","name_zh":"GB Recompiled Game Boy 静态重编译器","url":"https://github.com/arcanite24/gb-recompiled","evidence_url":"https://github.com/arcanite24/gb-recompiled/blob/9150f87d82fa98abcb6ea22329170463f9702eb8/README.md","description_en":"Static recompiler that turns Game Boy and Game Boy Color ROMs into portable C projects: it decodes and analyzes banked LR35902 code, emits C with machine-readable metadata, and links it with a shared SDL2 runtime for video, audio, input, saves and hardware timing. Jump targets that static analysis missed fall back to an interpreter. The repository also carries differential, replay and frame and audio capture tooling, plus a Pokémon Crystal port that builds native features on hooks into the exact ROM.","description_zh":"将 Game Boy 和 Game Boy Color ROM 转换为可移植 C 项目的静态重编译器：它解码并分析分 bank 的 LR35902 代码，生成 C 代码及机器可读的元数据，再与共享的 SDL2 运行时链接，由运行时处理视频、音频、输入、存档和硬件时序。静态分析未覆盖的跳转目标会回退到解释器执行。仓库还提供差分对比、回放以及画面和音频捕获工具，并附有一个 Pokémon Crystal 移植，借助对特定 ROM 的挂钩实现原生功能。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"codemerxdecompile","name":"CodemerxDecompile","name_zh":"CodemerxDecompile .NET 反编译器","url":"https://github.com/codemerx/CodemerxDecompile","evidence_url":"https://github.com/codemerx/CodemerxDecompile/blob/9ada3065e65112895445745aef888b9fb6fb46a7/README.md","description_en":"Cross-platform desktop .NET decompiler maintained by the original JustDecompile creators as a continuation of their JustDecompile Engine, built with Mono.Cecil and an Avalonia UI. It loads assemblies into a tree of namespaces, types, members and resolved references, shows decompiled C#, VB.NET or IL with go-to-definition and back/forward navigation, and searches names, types, string literals and instructions. A create-project command exports an assembly as a Visual Studio 2015, 2017 or 2019 project.","description_zh":"由 JustDecompile 原班开发者维护的跨平台桌面 .NET 反编译器，是其 JustDecompile 引擎的延续，基于 Mono.Cecil 并采用 Avalonia 界面。它把程序集加载为由命名空间、类型、成员和已解析引用组成的树，以 C#、VB.NET 或 IL 显示反编译结果，支持转到定义和前进／后退导航，并可搜索名称、类型、字符串字面量和指令。“创建项目”命令可将程序集导出为 Visual Studio 2015、2017 或 2019 项目。","kind":"tool","category":"dotnet","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"reverify-claim-verifier","name":"Reverify","name_zh":"Reverify：用确定性工具核验模型二进制分析断言","url":"https://github.com/2akouwu/reverify","evidence_url":"https://github.com/2akouwu/reverify/blob/f32ea84ccd6bb2aff90eca711ccfdbf04e6b8923/README.md","description_en":"Python CLI and stdio MCP server that checks a model’s structured claims about a binary, such as bytes or typed values at an offset, strings, imports and exports, instruction mnemonics, emulation results and tested or Z3-proved equivalence, and returns VERIFIED, REFUTED or INCONCLUSIVE with the evidence the tools observed. Grounded and refuted results are kept in a per-binary ledger on disk, so a reset or later session resumes from them instead of from a summary, and a reconstruct loop has a model propose claims until an informative set verifies. A separate rollover command replaces context compaction in Claude Code, Codex, Gemini CLI or OpenCode with file hand-offs and fresh sessions.","description_zh":"Python 命令行工具和 stdio MCP 服务器，用于检查模型对二进制文件提出的结构化断言，例如某偏移处的字节或类型化数值、字符串、导入与导出、指令助记符、模拟执行结果，以及经测试或经 Z3 证明的等价性，并连同工具实际观察到的证据返回 VERIFIED、REFUTED 或 INCONCLUSIVE。已确证和已驳斥的结果保存在磁盘上按二进制文件划分的台账中，重置后或之后的会话可据此继续，而不依赖摘要；reconstruct 循环则让模型不断提出断言，直至一组有信息量的断言通过验证。另有 rollover 命令，用文件交接和新会话取代 Claude Code、Codex、Gemini CLI 或 OpenCode 的上下文压缩。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"wux1an-wxapkg","name":"wxapkg","name_zh":"wxapkg 微信小程序解包工具","url":"https://github.com/wux1an/wxapkg","evidence_url":"https://github.com/wux1an/wxapkg/blob/bae9b0f4c405ae9dfa0474daa54bb97e2074c571/README.md","description_en":"Desktop GUI for Windows and macOS, built with Wails, that unpacks WeChat mini-program .wxapkg packages for study. It scans the mini-program package folders of local WeChat 3.x and 4.x installations, including per-user folders, or takes a file or folder the user selects; packages that the PC client stores encrypted are decrypted first. Each packaged file is written to its recorded path, with optional beautification of JSON, HTML and JavaScript.","description_zh":"基于 Wails 构建的 Windows 与 macOS 桌面图形工具，用于解包微信小程序 .wxapkg 包以供研究。它会扫描本机微信 3.x 和 4.x 安装中的小程序包目录（包括各用户目录），也可处理用户选定的文件或目录；PC 客户端以加密形式存储的包会先行解密。包内每个文件都按其记录的路径写出，并可选择美化 JSON、HTML 和 JavaScript 代码。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"react-native-decompiler","name":"React Native Decompiler","name_zh":"React Native 反编译器","url":"https://github.com/numandev1/react-native-decompiler","evidence_url":"https://github.com/numandev1/react-native-decompiler/blob/77c7b94e986c67b95c9dad5e619b118ef17bbe17/README.md","description_en":"Alpha-stage Node.js CLI that splits a React Native JavaScript bundle (index.android.bundle or main.jsbundle), an unbundled js-modules folder, or Webpack entrypoint and chunk bundles into one readable file per module. Tagger, editor and decompiler plugins working on a Babel AST undo compilation artifacts such as Babel helpers, comma-operator chains and shortened booleans, turn element calls back into JSX and can rewrite modules as ES6 imports and exports, after which ESLint and Prettier tidy the output. Modules recognized as npm packages are skipped unless requested, and one module ID can limit output to that module and its dependencies.","description_zh":"处于 Alpha 阶段的 Node.js 命令行工具，可把 React Native 的 JavaScript 包（index.android.bundle 或 main.jsbundle）、未打包应用的 js-modules 目录，或 Webpack 入口包与分块包拆分为每个模块一个、便于阅读的文件。基于 Babel AST 的标注器、编辑器和反编译器插件会消除 Babel 辅助函数、逗号运算符链和缩写布尔值等编译痕迹，把元素创建调用还原为 JSX，并可将模块改写为 ES6 import／export 形式，最后用 ESLint 和 Prettier 整理输出。被识别为 npm 包的模块默认跳过，也可指定一个模块 ID，只输出该模块及其依赖。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"decompai","name":"DecompAI","name_zh":"DecompAI：在 Kali 容器中分析二进制的对话智能体","url":"https://github.com/louisgthier/decompai","evidence_url":"https://github.com/louisgthier/decompai/blob/0c2398c09e318be1bb6f6a52d13e572fac7c519b/README.md","description_en":"Gradio chat application whose LangGraph ReAct agent analyses an uploaded x86 Linux ELF binary: it lists and disassembles functions, decompiles them with Ghidra, drives radare2 and gdb, and runs shell commands and Python scripts in a privileged Kali Linux runner container. Workspaces are keyed by the binary’s SHA-256, so uploading the same file again restores the session. It came out of a school research project, and its CTF results are the authors’ own report.","description_zh":"Gradio 对话应用，其 LangGraph ReAct 智能体分析使用者上传的 x86 Linux ELF 二进制文件：列出并反汇编函数，用 Ghidra 反编译，调用 radare2 和 gdb，并在特权模式的 Kali Linux 运行容器中执行 shell 命令和 Python 脚本。工作区以二进制文件的 SHA-256 为键，再次上传同一文件即可恢复会话。该项目源自一项学校研究计划，其 CTF 成绩为作者自述。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"dtk-template","name":"dtk-template","name_zh":"dtk-template GameCube/Wii 反编译项目模板","url":"https://github.com/encounter/dtk-template","evidence_url":"https://github.com/encounter/dtk-template/blob/95a941f755919ebe50c1725a4ce73524470e7a02/README.md","description_en":"Project template for starting GameCube and Wii matching-decompilation repositories around decomp-toolkit. Its configure.py generates a ninja build that analyzes and splits the game's DOL and REL files from per-version config.yml, symbols.txt and splits.txt files, compiles the decompiled C/C++ with period Metrowerks compilers, relinks the result and checks it against recorded SHA-1 hashes. It also wires in objdiff for per-object diffing, progress reporting for decomp.dev and an example GitHub Actions workflow.","description_zh":"用于围绕 decomp-toolkit 创建 GameCube 和 Wii 匹配反编译仓库的项目模板。其 configure.py 生成 ninja 构建：依据各版本的 config.yml、symbols.txt 和 splits.txt 分析并拆分游戏的 DOL 和 REL 文件，用当年的 Metrowerks 编译器编译反编译出的 C/C++ 代码，重新链接后与记录的 SHA-1 哈希核对。模板还集成了用于逐目标文件比对的 objdiff、面向 decomp.dev 的进度报告，以及一个 GitHub Actions 工作流示例。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-19"},{"id":"hermes-decomp","name":"hermes-decomp","name_zh":"hermes-decomp Hermes 字节码反编译器","url":"https://github.com/SymbioticSec/hermes-decomp","evidence_url":"https://github.com/SymbioticSec/hermes-decomp/blob/ad4c924720848a26136a56688b70339fe9ea7aba/README.md","description_en":"Rust decompiler and analysis toolkit for Hermes bytecode (.hbc), the compiled form React Native apps ship for the Hermes engine; the README lists HBC versions 40 to 99. Its hermes-decomp CLI shows file information, disassembles, decompiles whole bundles or single functions to JavaScript, with a slower deep mode that recovers more names, and provides a terminal UI, cross-references, call graphs, control-flow graphs, Metro module and closure views and bytecode diffing. A separate hermes-mcp server exposes the read and analysis functions as MCP tools, and the hbc-decomp crate offers them as a Rust library.","description_zh":"面向 Hermes 字节码（.hbc）的 Rust 反编译与分析工具包；.hbc 是 React Native 应用为 Hermes 引擎打包的编译格式，README 列出支持 HBC 40 至 99 版本。其 hermes-decomp 命令行可显示文件信息、反汇编，并将整个包或单个函数反编译为 JavaScript，较慢的深度模式还能恢复更多名称；此外提供终端界面、交叉引用、调用图、控制流图、Metro 模块与闭包视图以及字节码差异比较。独立的 hermes-mcp 服务器将读取和分析功能作为 MCP 工具提供，hbc-decomp crate 则以 Rust 库的形式提供这些功能。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"n64modernruntime","name":"N64ModernRuntime","name_zh":"N64ModernRuntime N64 重编译运行时","url":"https://github.com/N64Recomp/N64ModernRuntime","evidence_url":"https://github.com/N64Recomp/N64ModernRuntime/blob/cdf5abbd5026fef5c364c676e4667c45e42b6863/README.md","description_en":"Runtime for N64Recomp static recompilations and traditional source ports of N64 games, made of two libraries. ultramodern reimplements core libultra services (threads, message queues, timers, controllers, audio, RSP task handling and VI timing) and leaves controller input, audio playback and the graphics renderer, with RT64 recommended, to callbacks the host project registers. librecomp bridges N64Recomp-generated code to ultramodern and adds overlay handling, PI DMA ROM reads, and EEPROM, SRAM and Flash RAM saves.","description_zh":"供 N64Recomp 静态重编译项目和传统源码移植使用的 N64 游戏运行时，由两个库组成。ultramodern 重新实现 libultra 的核心服务（线程、消息队列、计时器、控制器、音频、RSP 任务处理和 VI 时序），并将手柄输入、音频播放和图形渲染器（推荐 RT64）交给宿主项目注册的回调处理。librecomp 负责将 N64Recomp 生成的代码与 ultramodern 衔接，并补充覆盖段处理、PI DMA 读取 ROM，以及 EEPROM、SRAM 和 Flash RAM 存档。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-19"},{"id":"redscript","name":"REDscript","name_zh":"REDscript《赛博朋克 2077》脚本编译与反编译工具集","url":"https://github.com/jac3km4/redscript","evidence_url":"https://github.com/jac3km4/redscript/blob/3ca666c8ec14cfc803ef3888aab6ebc7a1c2bb86/README.md","description_en":"Compiler and decompiler toolkit for REDscript, a statically typed, object-oriented language for writing scripts for REDengine, CD Projekt's engine used in Cyberpunk 2077. Its Rust crates parse and analyze source, generate bytecode with monomorphization of generics, decompile .redscripts bytecode bundles back into REDscript source, read and write REDengine's native binary format, and provide a drop-in replacement for CD Projekt's scc script compiler plus a C API with source mapping. The CLI exposes decompile, compile, lint and format commands; the language server and debugger live in a separate redscript-ide repository.","description_zh":"REDscript 的编译器与反编译器工具集。REDscript 是一种静态类型、面向对象的语言，用于为 CD Projekt 在《赛博朋克 2077》中使用的 REDengine 引擎编写脚本。其 Rust crate 负责解析和分析源码、生成字节码并对泛型做单态化、将 .redscripts 字节码包反编译回 REDscript 源码、读写 REDengine 原生二进制格式，并提供可直接替代 CD Projekt scc 脚本编译器的实现，以及带源码映射的 C API。命令行提供 decompile、compile、lint 和 format 命令；语言服务器和调试器位于单独的 redscript-ide 仓库。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-19"},{"id":"kong-agentic-reverse-engineer","name":"Kong","name_zh":"Kong：基于 Ghidra 的大模型去符号二进制分析流水线","url":"https://github.com/amruth-sn/kong","evidence_url":"https://github.com/amruth-sn/kong/blob/8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2/README.md","description_en":"Command-line pipeline that runs Ghidra in-process through PyGhidra and asks Claude, OpenAI or OpenAI-compatible models to name the functions, types and parameters of a stripped binary, working bottom-up through the call graph so callers see already-named callees. It matches known library and cryptographic signatures first, sends functions whose decompilation looks obfuscated through a tool-using deobfuscation pass with z3-based simplification, applies results to the Ghidra program and exports annotated C and an analysis.json file. Its README calls it the first agentic reverse engineer; that label and its accuracy and cost figures are the author’s claims.","description_zh":"命令行分析流水线，通过 PyGhidra 在进程内运行 Ghidra，请 Claude、OpenAI 或兼容 OpenAI 接口的模型为去符号二进制文件中的函数、类型和参数命名，并沿调用图自底向上处理，使调用者能看到已命名的被调函数。它先匹配已知库函数与密码算法特征，再把反编译结果疑似混淆的函数交给可调用工具、借助 z3 化简的去混淆环节，将结果应用到 Ghidra 程序中，并导出带注释的 C 代码和 analysis.json 文件。README 称其为首个智能体逆向工程师，这一说法以及其中的准确性和成本数据均为作者陈述。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"spice86","name":"Spice86","name_zh":"Spice86 实模式 DOS 逆向与重写模拟器","url":"https://github.com/OpenRakis/Spice86","evidence_url":"https://github.com/OpenRakis/Spice86/blob/28a877fc64888f070e2dad95ddb739f3e1fe84a2/README.md","description_en":"PC emulator for executing, reverse engineering and rewriting real-mode DOS programs whose source code is unavailable. While a program runs it builds a control-flow graph, and on exit it dumps memory, execution flow, Ghidra-compatible symbols and a self-contained, runnable C# project whose generated functions override the original assembly, so analysts can rewrite them function by function into readable code while the program keeps working. It also provides a GDB remote server with custom analysis commands, a built-in debugger with a C-header structure viewer, an optional HTTP memory API and an MCP server whose tools cover CPU, memory, breakpoints, CFG and device state; an optional Ghidra plugin imports the dumps.","description_zh":"用于执行、逆向分析并重写无源码实模式 DOS 程序的 PC 模拟器。程序运行时它会构建控制流图，退出时转储内存、执行流、Ghidra 兼容的符号，以及一个可独立运行的 C# 项目，其中生成的函数会覆盖原有汇编代码，分析者可以在程序始终可运行的前提下逐个函数将其改写为可读代码。它还提供带自定义分析命令的 GDB 远程服务器、配有 C 头文件结构查看器的内置调试器、可选的 HTTP 内存 API，以及工具覆盖 CPU、内存、断点、控制流图和设备状态的 MCP 服务器；可选的 Ghidra 插件可导入这些转储。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"ps2-web-recomp","name":"PS2 Web Recomp","name_zh":"PS2 Web Recomp 浏览器游戏重编译工具","url":"https://github.com/snuri00/ps2-web-recomp","evidence_url":"https://github.com/snuri00/ps2-web-recomp/blob/6526f4803d98e10de50bea3af104a4d26e9df033/README.md","description_en":"Statically recompiles PlayStation 2 games for the browser: eerecomp translates the Emotion Engine code of a game's boot executable into C++ that is compiled to WebAssembly, and a runtime emulates the rest of the console, including a high-level EE kernel, an interpreted I/O processor running the disc's IRX modules, the vector units, SPU2 sound and the Graphics Synthesizer on WebGPU compute shaders. Its port script repeats headless runs to find functions reached through pointers and vector-unit microprograms to compile ahead of time, then builds the web page and a native runner.","description_zh":"将 PlayStation 2 游戏静态重编译后在浏览器中运行：eerecomp 把游戏启动程序中的 Emotion Engine 代码转换为 C++，再编译为 WebAssembly；运行时负责仿真主机的其余部分，包括高层仿真的 EE 内核、以解释器运行光盘 IRX 模块的 I/O 处理器、向量单元、SPU2 音频，以及基于 WebGPU 计算着色器的 Graphics Synthesizer。其移植脚本会反复进行无界面运行，找出经指针调用的函数和需要预先编译的向量单元微程序，最后构建网页和原生运行程序。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"shuji","name":"shuji","name_zh":"shuji 源映射源码恢复工具","url":"https://github.com/paazmaya/shuji","evidence_url":"https://github.com/paazmaya/shuji/blob/a97c6df48e2016fde7b072d3e8475dea3d7b872c/README.md","description_en":"Command-line tool that writes the original JavaScript and CSS sources embedded in source maps back out as files. It reads .map files, or JavaScript and CSS files whose sourceMappingURL holds an inline Base64 or URL-encoded map or points to a map in the same folder, and can walk directories with a regular-expression filter. Output is flattened to file names by default, or keeps the map's folder structure with --preserve.","description_zh":"命令行工具，可把源映射（source map）中内嵌的原始 JavaScript 和 CSS 源码重新写出为文件。它能读取 .map 文件，也能读取 sourceMappingURL 中内联了 Base64 或 URL 编码映射、或指向同一目录下映射文件的 JavaScript 和 CSS 文件，并可按正则表达式筛选、递归遍历目录。默认只按文件名平铺输出，使用 --preserve 则保留映射中的目录结构。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"xboxrecomp","name":"xboxrecomp","name_zh":"xboxrecomp 初代 Xbox 静态重编译工具包","url":"https://github.com/sp00nznet/xboxrecomp","evidence_url":"https://github.com/sp00nznet/xboxrecomp/blob/eb0aa1d5fcb1ca34cdb6470fcfa471d87f431d73/README.md","description_en":"Static-recompilation toolkit for original Xbox games: a Python pipeline parses a retail XBE, disassembles it, classifies library functions, recovers calling conventions and lifts every x86 function to C. The generated code is compiled in a separate game project that links the toolkit's runtime libraries, which stand in for the Xbox kernel and translate Direct3D 8, NV2A, audio and input to Direct3D 11 and Win32 APIs, or to SDL2 and OpenGL on Linux and macOS.","description_zh":"面向初代 Xbox 游戏的静态重编译工具包：Python 流水线解析零售版 XBE，进行反汇编、识别库函数、恢复调用约定，并将每个 x86 函数提升为 C 代码。生成的代码在独立的游戏项目中编译，并链接工具包的运行时库；这些库替代 Xbox 内核，并将 Direct3D 8、NV2A、音频和输入转换到 Direct3D 11 与 Win32 API，在 Linux 和 macOS 上则转换到 SDL2 与 OpenGL。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"pcsx-redux","name":"PCSX-Redux","name_zh":"PCSX-Redux PlayStation 1 调试模拟器","url":"https://github.com/grumpycoders/pcsx-redux","evidence_url":"https://github.com/grumpycoders/pcsx-redux/blob/e1693b7f756ebdc4ccae1230ed09992079b51f90/README.md","description_en":"PlayStation 1 emulator forked from PCSX and built around development and reverse engineering, with an interpreter and dynamic recompiler, software and OpenGL renderers, a MIPS debugger, VRAM viewer, SPU and GPU debugging tools, and a built-in GDB server that its documentation connects to gdb, IDA Pro and Ghidra's debugger. A LuaJIT API exposes breakpoints, memory and registers, an assembler and an ISO builder, and an optional REST web server can dump RAM and VRAM. The repository also holds the OpenBIOS replacement BIOS, PS-EXE conversion and packing tools, a Psy-Q object-file converter, Ghidra scripts for exchanging symbols and overlays with the emulator, and PS1 hardware designs.","description_zh":"基于 PCSX 分支、面向开发与逆向工程的 PlayStation 1 模拟器，提供解释器与动态重编译器、软件和 OpenGL 渲染器、MIPS 调试器、显存查看器、SPU 与 GPU 调试工具，以及内置 GDB 服务器；其文档说明了如何用 gdb、IDA Pro 和 Ghidra 调试器连接它。LuaJIT API 提供断点、内存与寄存器、汇编器和 ISO 构建器等接口，可选的 REST Web 服务器还能转储内存和显存。仓库另含替代 BIOS OpenBIOS、PS-EXE 转换与打包工具、Psy-Q 目标文件转换器、用于与模拟器交换符号和覆盖段的 Ghidra 脚本，以及 PS1 硬件设计。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"obfuscator-io-deobfuscator","name":"Obfuscator.io Deobfuscator","name_zh":"Obfuscator.io 专用反混淆工具","url":"https://github.com/ben-sb/obfuscator-io-deobfuscator","evidence_url":"https://github.com/ben-sb/obfuscator-io-deobfuscator/blob/42efc019d375f3cc266887ec36e929905836639c/README.md","description_en":"Deobfuscator dedicated to JavaScript produced by Obfuscator.io (javascript-obfuscator), which its README says also handles most forks. Working statically on a Babel AST, it reveals strings hidden in rotated, Base64- or RC4-encoded string arrays, inlines proxy functions, simplifies objects, arithmetic and string concatenation, removes dead code and the obfuscator's anti-tamper wrappers, and reverses control-flow flattening. Its configuration is detected automatically, and the author also hosts an online version.","description_zh":"专门处理 Obfuscator.io（javascript-obfuscator）所生成 JavaScript 的反混淆工具，README 称也能处理其大部分分支版本。它在 Babel AST 上进行静态处理，可还原隐藏在经过轮转、Base64 或 RC4 编码的字符串数组中的字符串，内联代理函数，化简对象、算术表达式和字符串拼接，删除死代码和混淆器的防篡改包装代码，并还原控制流平坦化。配置会自动检测，作者另提供在线版本。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"decomp2dbg","name":"decomp2dbg","name_zh":"decomp2dbg 反编译器-调试器符号同步工具","url":"https://github.com/mahaloz/decomp2dbg","evidence_url":"https://github.com/mahaloz/decomp2dbg/blob/416dce4986f90c74876ddb00af18583f8de6e4fe/README.md","description_en":"Decompiler-to-debugger bridge that serves function names, global variables, stack and register variable names and decompiled code from IDA Pro, Binary Ninja, Ghidra or angr-management to GDB over an XML-RPC connection. Synced functions and globals become ordinary GDB symbols for breakpoints and memory examination, local variables appear as convenience variables, and each breakpoint stop prints the decompiled line for the current address. It works with vanilla GDB, GEF and pwndbg, and can map a shared library's symbols once its load range is supplied.","description_zh":"连通反编译器与调试器的桥接工具：通过 XML-RPC 连接，把 IDA Pro、Binary Ninja、Ghidra 或 angr-management 中的函数名、全局变量、栈变量与寄存器变量名以及反编译代码提供给 GDB。同步过来的函数和全局变量成为普通的 GDB 符号，可直接下断点和查看内存；局部变量以便利变量的形式出现，每次在断点处停下时还会打印当前地址对应的反编译代码行。它支持原生 GDB、GEF 和 pwndbg；提供共享库的加载地址范围后，也能为该库映射符号。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"ben-sb-javascript-deobfuscator","name":"javascript-deobfuscator","name_zh":"javascript-deobfuscator 通用 JavaScript 反混淆工具","url":"https://github.com/ben-sb/javascript-deobfuscator","evidence_url":"https://github.com/ben-sb/javascript-deobfuscator/blob/4107a8a59d9a2267f921148cb33d3abf0bf6d128/README.md","description_en":"General-purpose JavaScript deobfuscator for common obfuscation patterns, published on npm as js-deobfuscator and usable as a library or CLI. It unpacks arrays of literals and replaces references to them, removes simple, array and arithmetic proxy functions, simplifies arithmetic and string concatenation, removes dead branches, turns computed member access into static properties, renames hexadecimal identifiers such as _0xca830a and beautifies the result. The author also hosts an online version and maintains a separate deobfuscator for Obfuscator.io output.","description_zh":"通用的 JavaScript 反混淆工具，针对常见混淆手法，以 js-deobfuscator 之名发布在 npm 上，可作为库或命令行工具使用。它能展开字面量数组并替换对其的引用，移除简单代理函数、数组代理函数和算术代理函数，化简算术表达式和字符串拼接，删除死分支，把计算属性访问转为静态属性，重命名 _0xca830a 这类十六进制标识符，并美化输出代码。作者另提供在线版本，并单独维护一个针对 Obfuscator.io 输出的反混淆工具。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"il2cppinspector","name":"Il2CppInspector","name_zh":"Il2CppInspector Unity IL2CPP 静态分析工具","url":"https://github.com/djkaty/Il2CppInspector","evidence_url":"https://github.com/djkaty/Il2CppInspector/blob/116c6355e7ee3656eab85ca753f913d428abc7a3/README.md","description_en":"Static analysis tool for Unity IL2CPP applications that reads an IL2CPP binary with its global-metadata.dat and outputs the application's type structure and method addresses as C# stub code, .NET assembly shim DLLs for decompilers such as ILSpy and dnSpy, IDA and Ghidra Python scripts that apply symbols and types, C++ type scaffolding and JSON address maps. Three APIs, also published as a NuGet package, and a plugin SDK expose the binary metadata, .NET type model and C++ model for custom analysis. The README states that it is not a decompiler and does not recover method source code.","description_zh":"面向 Unity IL2CPP 应用的静态分析工具：读取 IL2CPP 二进制及其 global-metadata.dat，将应用的类型结构和方法地址输出为 C# 存根代码、供 ILSpy 和 dnSpy 等反编译器使用的 .NET 程序集垫片 DLL、为 IDA 和 Ghidra 套用符号与类型的 Python 脚本、C++ 类型脚手架以及 JSON 地址映射。三套 API（另以 NuGet 包发布）和插件 SDK 开放二进制元数据、.NET 类型模型和 C++ 模型，供自定义分析使用。README 说明它不是反编译器，不会还原方法源码。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["app","binary","game"],"verified_at":"2026-10-19"},{"id":"whatsapp-web-reveng-legacy-protocol-case","name":"whatsapp-web-reveng: documenting the legacy WhatsApp Web protocol","name_zh":"whatsapp-web-reveng：记录旧版 WhatsApp Web 协议","url":"https://github.com/sigalor/whatsapp-web-reveng","evidence_url":"https://github.com/sigalor/whatsapp-web-reveng/blob/04caed2b23680d23a3f39cf2b017c064ff1e85ed/README.md","description_en":"Documents and reimplements the WebSocket protocol WhatsApp Web used while browser sessions mirrored a paired phone: QR pairing, Curve25519/HKDF key setup, AES/HMAC-protected binary messages, the token-based node encoding and end-to-end media encryption. A Python backend, Node.js relay and browser front end decode a logged-in session’s messages into inspectable JSON, and the README lists independent reimplementations such as Baileys and go-whatsapp. This is an older protocol generation from before WhatsApp’s 2021 multi-device architecture, not a description of current WhatsApp Web.","description_zh":"记录并重新实现 WhatsApp Web 在浏览器会话镜像已配对手机时期使用的 WebSocket 协议：二维码配对、Curve25519/HKDF 密钥建立、经 AES/HMAC 保护的二进制报文、基于字符串令牌表的节点编码，以及端到端媒体加密。Python 后端、Node.js 中继和浏览器前端把已登录会话的报文解码成可查看的 JSON，README 还列出了 Baileys、go-whatsapp 等独立再实现。这是 WhatsApp 2021 年多设备架构之前的旧一代协议，不能当作对当前 WhatsApp Web 的描述。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol","website"],"verified_at":"2026-10-19"},{"id":"e9patch","name":"E9Patch","name_zh":"E9Patch 静态二进制重写工具","url":"https://github.com/GJDuck/e9patch","evidence_url":"https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/README.md","description_en":"Static binary rewriter for x86-64 Linux ELF executables and shared objects that inserts instrumentation without control-flow recovery and writes a drop-in replacement binary, following the PLDI 2020 paper Binary Rewriting without Control Flow Recovery. The e9tool front end selects instructions with a matching language over disassembly attributes and patches them with built-in trampolines, calls into C or C++ functions compiled with e9compile.sh, or hand-written plugin trampolines; the e9patch back end accepts JSON-RPC commands so other tools can drive it. Optional modes add heuristic control-flow recovery for faster rewritten binaries or SIGILL-based fallbacks for full patch coverage.","description_zh":"面向 x86-64 Linux ELF 可执行文件和共享库的静态二进制重写工具，无需恢复控制流即可插入插桩代码，并生成可直接替换原文件的二进制，方法源自 PLDI 2020 论文《无需控制流恢复的二进制重写》。前端 e9tool 用一套基于反汇编属性的匹配语言选择指令，再通过内置跳板、调用以 e9compile.sh 编译的 C/C++ 函数或手写的插件跳板进行修补；后端 e9patch 接收 JSON-RPC 命令，便于其他工具调用。可选模式包括借助启发式控制流恢复获得更快的重写结果，或借助 SIGILL 回退实现完全的修补覆盖。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"melonloader","name":"MelonLoader","name_zh":"MelonLoader Unity 游戏模组加载器","url":"https://github.com/LavaGang/MelonLoader","evidence_url":"https://github.com/LavaGang/MelonLoader/blob/5aff4d9d7c16ae153aad2f1035114dbc2713bf99/README.md","description_en":"Mod loader for Unity games on both the Mono and IL2CPP runtimes, which loads plugins and mods from folders in a locally installed game; on Windows a proxy DLL, version.dll by default, starts it with the game. For IL2CPP games its assembly generator runs Cpp2IL and Il2CppInterop to produce managed interop assemblies, and HarmonyX and MonoMod are bundled for runtime patching. Its logs can capture Unity player output and Harmony messages, and debug options provide a Mono debug server for Mono games and a wait-for-debugger option for IL2CPP games.","description_zh":"面向 Mono 和 IL2CPP 两种运行时 Unity 游戏的模组加载器，从本地安装游戏目录中的文件夹加载插件和模组；在 Windows 上通过代理 DLL（默认为 version.dll）随游戏一同启动。对于 IL2CPP 游戏，其程序集生成器会调用 Cpp2IL 和 Il2CppInterop 生成托管互操作程序集，并随附 HarmonyX 与 MonoMod 用于运行时修补。其日志可捕获 Unity 播放器输出与 Harmony 消息，调试选项还为 Mono 游戏提供 Mono 调试服务器，为 IL2CPP 游戏提供等待调试器附加的选项。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-19"},{"id":"rellic","name":"Rellic","name_zh":"Rellic LLVM bitcode 转 C 反编译器","url":"https://github.com/lifting-bits/rellic","evidence_url":"https://github.com/lifting-bits/rellic/blob/370abaad86ae5adad82f85b81aff14557462b7f2/README.md","description_en":"Trail of Bits implementation of the pattern-independent structuring algorithm from the No More Gotos paper, turning LLVM bitcode into goto-free C as a small, hackable decompiler back end that interoperates with LLVM and Remill. rellic-decomp translates a bitcode module to C in batch, rellic-xref serves a web interface for choosing refinement passes and linking C AST nodes to the bitcode that produced them, and rellic-headergen emits C layouts of data structures from a module's DWARF metadata. Machine code must first be lifted to bitcode by another tool; a bundled IDA script uses Anvill for that step.","description_zh":"Trail of Bits 对 No More Gotos 论文中模式无关结构化算法的实现，可把 LLVM bitcode 转换为不含 goto 的 C 代码，定位为小巧、易于修改且能与 LLVM 和 Remill 互操作的反编译器后端。rellic-decomp 批量将 bitcode 模块转换为 C；rellic-xref 提供 Web 界面，可选择要应用的细化遍，并将 C AST 节点与生成它的 bitcode 相互对应；rellic-headergen 根据模块中的 DWARF 元数据生成描述数据结构布局的 C 代码。机器码须先由其他工具提升为 bitcode；仓库附带的 IDA 脚本借助 Anvill 完成这一步。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"ghidra-delinker-extension","name":"ghidra-delinker-extension","name_zh":"ghidra-delinker-extension Ghidra 目标文件反链接扩展","url":"https://github.com/boricj/ghidra-delinker-extension","evidence_url":"https://github.com/boricj/ghidra-delinker-extension/blob/b3890c4443e4ab802c26b66d84821d3ac9362c18/README.md","description_en":"Ghidra extension that delinks a selected part of a program back into a relocatable object file. Its relocation table synthesizer analyzer reconstructs, from the Ghidra database, the relocations a linker normally discards, and its exporters write COFF (x86, x86-64), ELF (x86, x86-64, MIPS) or OMF (x86) objects with symbols and relocation tables that a toolchain can link again. The README lists binary patching through the linker, software ports, format conversion, library extraction and decompilation projects that reimplement a program one object file at a time among its uses.","description_zh":"Ghidra 扩展，可把程序中选定的部分“反链接”回可重定位目标文件。其重定位表合成分析器根据 Ghidra 数据库重建链接器通常会丢弃的重定位信息，导出器则写出带符号表和重定位表、可由工具链重新链接的 COFF（x86、x86-64）、ELF（x86、x86-64、MIPS）或 OMF（x86）目标文件。README 列出的用途包括借助链接器打二进制补丁、软件移植、格式转换、提取库，以及逐个目标文件重新实现程序的反编译项目。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"bepinex","name":"BepInEx","name_zh":"BepInEx Unity/.NET 游戏插件与修补框架","url":"https://github.com/BepInEx/BepInEx","evidence_url":"https://github.com/BepInEx/BepInEx/blob/6cea286d204eb3754d3b8363a5a1fd6640164a49/README.md","description_en":"Plugin and patching framework for Unity Mono, Unity IL2CPP and .NET Framework games such as XNA, FNA and MonoGame titles, which loads mods and analysis plugins into a locally installed game. Plugins patch methods at runtime with the bundled HarmonyX and MonoMod.RuntimeDetour, while preloader patchers rewrite managed assemblies with Mono.Cecil before the game loads them; on IL2CPP games it runs Cpp2IL and Il2CppInterop to generate interop assemblies from the game binary and global-metadata.dat. Its guides also cover configuration, logging, and debugging plugins and game assemblies with dnSpy.","description_zh":"面向 Unity Mono、Unity IL2CPP 以及 XNA、FNA、MonoGame 等 .NET Framework 游戏的插件与修补框架，可将模组和分析插件加载到本地安装的游戏中。插件借助随附的 HarmonyX 和 MonoMod.RuntimeDetour 在运行时修补方法，预加载修补器则在游戏加载托管程序集之前用 Mono.Cecil 改写它们；在 IL2CPP 游戏上，它会调用 Cpp2IL 和 Il2CppInterop，从游戏二进制和 global-metadata.dat 生成互操作程序集。其指南还介绍了配置、日志，以及用 dnSpy 调试插件和游戏程序集。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-19"},{"id":"binexport","name":"BinExport","name_zh":"BinExport 反汇编导出插件","url":"https://github.com/google/binexport","evidence_url":"https://github.com/google/binexport/blob/1fc1d734db5924c9bc9067ae244cb9b94c94efcb/README.md","description_en":"The exporter component of BinDiff: plugins for IDA Pro and Binary Ninja and an extension for Ghidra that write an analyzed disassembly to the Protocol Buffer format BinDiff requires. The BinExport2 schema covers instructions with their operands and expressions, basic blocks, flow graphs, the call graph, sections, strings, comments and data references; the exporter can also write a statistics text file or a text dump for debugging. Exports can be scripted through IDC or IDAPython in IDA and through a BinExport.java script that also runs in Ghidra's headless analyzer.","description_zh":"BinDiff 的导出组件：为 IDA Pro 和 Binary Ninja 提供插件、为 Ghidra 提供扩展，把已分析的反汇编结果写成 BinDiff 所需的 Protocol Buffer 格式。BinExport2 模式涵盖带操作数和表达式的指令、基本块、流程图、调用图、节区、字符串、注释和数据引用；导出器还可输出统计文本文件或用于调试的文本转储。在 IDA 中可通过 IDC 或 IDAPython 脚本导出，在 Ghidra 中可使用同样能在无界面分析器中运行的 BinExport.java 脚本。","kind":"tool","category":"binary-diffing","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"karta","name":"Karta","name_zh":"Karta 开源库匹配插件","url":"https://github.com/CheckPointSW/Karta","evidence_url":"https://github.com/CheckPointSW/Karta/blob/7a3d0d302f59b2098b1792f1d4ac881e6c5d21b0/README.md","description_en":"Source-code-assisted IDA Python plugin from Check Point Research that finds and matches open-source libraries compiled into large binaries and firmware. Its identifier script reports which supported libraries, such as OpenSSL, zlib, libpng and net-snmp, are present and fingerprints their versions; the matcher then uses a JSON configuration built from that library version to locate its compiled files by their original function order, match their functions and the external libc functions they call, and export selected matches as IDA names. The bundled Thumbs Up scripts improve IDA's function analysis beforehand, including ARM/Thumb separation in firmware.","description_zh":"Check Point Research 开发的源码辅助 IDA Python 插件，用于在大型二进制和固件中查找并匹配编译进去的开源库。识别脚本会列出二进制中存在哪些受支持的库（如 OpenSSL、zlib、libpng 和 net-snmp），并识别其版本；匹配脚本再借助由该库版本生成的 JSON 配置，按原始函数顺序定位各个编译单元，匹配其中的函数及其调用的外部 libc 函数，并可把选定的匹配结果作为名称导入 IDA。附带的 Thumbs Up 脚本可预先改进 IDA 的函数分析，包括区分固件中的 ARM 与 Thumb 代码。","kind":"tool","category":"binary-diffing","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"vtil-core","name":"VTIL-Core","name_zh":"VTIL-Core 虚拟机翻译中间语言核心库","url":"https://github.com/vtil-project/VTIL-Core","evidence_url":"https://github.com/vtil-project/VTIL-Core/blob/9ebee8e890a3a8923cc41f07821f740910e7c9b2/README.md","description_en":"C++20 core of the VTIL (Virtual-machine Translation Intermediate Language) project, an intermediate language and optimizing compiler that the README describes as built for binary de-obfuscation and de-virtualization. Unlike LLVM IR, VTIL keeps the native stack, physical registers and non-SSA form, so code from register or stack machines can be lifted into it, native instructions can stay inline, and code can be emitted back at any virtual address. The library provides the IL with routines, basic blocks and serialization, a symbolic expression engine and simplifier, optimizer passes such as dead-code elimination, propagation and stack pinning, and Capstone/Keystone-based AMD64 and ARM64 disassembly and assembly helpers.","description_zh":"VTIL（Virtual-machine Translation Intermediate Language，虚拟机翻译中间语言）项目的 C++20 核心库。VTIL 是一种中间语言及优化编译器，README 称其专为二进制去混淆与去虚拟化分析而设计。与 LLVM IR 不同，VTIL 保留原生栈、物理寄存器和非 SSA 形式，因此寄存器机或栈机代码都能提升到其中，原生指令可直接嵌入 IL 流，代码也能重新输出到任意虚拟地址。该库提供包含例程、基本块和序列化的 IL、符号表达式引擎与化简器、死代码消除、传播和栈固定等优化遍，以及基于 Capstone/Keystone 的 AMD64 与 ARM64 反汇编和汇编辅助功能。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"efixplorer","name":"efiXplorer","name_zh":"efiXplorer UEFI 固件分析 IDA 插件","url":"https://github.com/REhints/efiXplorer","evidence_url":"https://github.com/REhints/efiXplorer/blob/9e3b40a2ac0524e04dc69540ab4ff911fda13d27/README.md","description_en":"IDA Pro plugin and loader that automate static analysis of UEFI firmware. The plugin annotates Boot, Runtime, SMM and PEI service calls, lists the EFI protocols and known GUIDs a module installs or consumes, applies protocol interface types in the Hex-Rays decompiler, flags suspected SMM callout and GetVariable out-of-bounds write patterns for review and saves a JSON report. The efiXloader module opens a whole firmware image in one IDA database, with driver entry points, navigation between drivers and a DXE driver dependency graph.","description_zh":"用于自动化 UEFI 固件静态分析的 IDA Pro 插件与加载器。插件可标注 Boot、Runtime、SMM 和 PEI 服务调用，列出模块安装或使用的 EFI 协议与已知 GUID，在 Hex-Rays 反编译器中应用协议接口类型，标记疑似 SMM callout 及 GetVariable 越界写入模式供人工复核，并保存 JSON 报告。efiXloader 加载模块可在单个 IDA 数据库中打开整个固件镜像，提供各驱动入口点、驱动间导航和 DXE 驱动依赖关系图。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"vscode-frida","name":"Frida Workbench for VSCode","name_zh":"Frida Workbench VS Code 扩展","url":"https://github.com/ChiChou/vscode-frida","evidence_url":"https://github.com/ChiChou/vscode-frida/blob/271aa369fbf8331047184766775a1f1b9332e13b/README.md","description_en":"Unofficial Visual Studio Code extension for Frida work. A sidebar lists apps and processes on local, Apple Simulator, USB and remote devices to attach, spawn or kill, and runtime panels browse an attached process's native modules and exports and its Java and Objective-C classes, methods and protocols; selected items generate Interceptor, Objective-C or Java hook scaffolds, optionally with GitHub Copilot-inferred native signatures, and Objective-C headers or Java class stubs can be dumped. A language server completes class, selector and module names from a live target, and the extension also scaffolds Frida agent and C-module projects, script-debugging configurations, syslog streaming and Android frida-server setup.","description_zh":"非官方的 Visual Studio Code 扩展，用于 Frida 相关工作。侧边栏列出本地、Apple 模拟器、USB 和远程设备上的应用与进程，可附加、启动或结束它们；运行时面板可浏览已附加进程的原生模块与导出函数，以及 Java 和 Objective-C 的类、方法与协议，并根据所选项目生成 Interceptor、Objective-C 或 Java 的 Hook 代码框架（可选用 GitHub Copilot 推断原生函数签名），还能导出 Objective-C 头文件或 Java 类存根。语言服务器根据运行中的目标补全类名、选择器和模块名；扩展还提供 Frida agent 与 C 模块项目脚手架、脚本调试配置、系统日志流以及 Android frida-server 部署。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"ghidriff","name":"ghidriff","name_zh":"ghidriff Ghidra 二进制差异分析引擎","url":"https://github.com/clearbluejar/ghidriff","evidence_url":"https://github.com/clearbluejar/ghidriff/blob/4f5d895fcbb1eacd65efd81145922c15bb7e741d/README.md","description_en":"Command-line binary diffing engine that drives Ghidra headlessly through pyghidra: it imports and analyzes an old and a new binary, then reports added, deleted and modified functions, with patch diffing as its main use. The default VersionTrackingDiff engine combines several Ghidra Version Tracking correlators with BSim matching, alongside simpler symbol-name and structural-graph engines and a GhidraDiffEngine base class for custom differs. Results are written as JSON and Markdown with Mermaid charts and meta diffs of strings, called and calling functions and binary metadata, plus optional side-by-side HTML.","description_zh":"命令行二进制差异分析引擎，通过 pyghidra 以无界面方式驱动 Ghidra：导入并分析新旧两个版本的二进制，列出新增、删除和修改的函数，主要用于补丁比对。默认的 VersionTrackingDiff 引擎组合了多个 Ghidra 版本跟踪关联器和 BSim 匹配，另有基于符号名和结构图的较简单引擎，并提供 GhidraDiffEngine 基类供编写自定义比对器。结果以 JSON 和带 Mermaid 图表的 Markdown 输出，附有字符串、被调用与调用函数及二进制元数据的元差异，也可另外生成并排对照的 HTML。","kind":"tool","category":"binary-diffing","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"vmlinux-to-elf","name":"vmlinux-to-elf","name_zh":"vmlinux-to-elf 内核符号恢复工具","url":"https://github.com/marin-m/vmlinux-to-elf","evidence_url":"https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/README.md","description_en":"Rebuild an analyzable ELF with function and variable symbols from a Linux kernel image, whether a raw or compressed vmlinux, vmlinuz, zImage or bzImage blob, certain Android boot.img files or a stripped kernel ELF, by locating and decoding the embedded kallsyms symbol table. It detects the compression format, instruction set, endianness, word size, entry point and an approximate base address and writes an ELF for IDA Pro or Ghidra; a kallsyms-finder listing, a standalone decompressor and a GTK GUI are included.","description_zh":"通过定位并解码内嵌的 kallsyms 符号表，从 Linux 内核镜像重建带函数与变量符号、可供分析的 ELF 文件；输入可以是原始或压缩的 vmlinux、vmlinuz、zImage、bzImage 数据块，部分 Android boot.img 文件，或已去除符号的内核 ELF。工具会检测压缩格式、指令集、字节序、位宽、入口点和近似基址，并生成可在 IDA Pro 或 Ghidra 中分析的 ELF；另附列出符号的 kallsyms-finder、独立解压工具和 GTK 图形界面。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"ddisasm","name":"Ddisasm","name_zh":"Ddisasm Datalog 可重汇编反汇编器","url":"https://github.com/GrammaTech/ddisasm","evidence_url":"https://github.com/GrammaTech/ddisasm/blob/1d17f292e3672078eeb753473847306ca3f0f1ff/README.md","description_en":"GrammaTech's Datalog disassembler, which turns ELF and PE binaries for x86-32, x86-64, ARM32, ARM64 and MIPS32 into the GTIRB intermediate representation. It decodes a superset of possible instructions, then applies Soufflé Datalog rules and weighted heuristics to infer code locations, symbolization and function boundaries; gtirb-pprinter turns the result into reassemblable assembly or a rebuilt binary, and the GTIRB APIs or gtirb-rewriting can modify it in between. User hint files add Datalog facts or change heuristic weights where inference goes wrong.","description_zh":"GrammaTech 开发的 Datalog 反汇编器，可将 x86-32、x86-64、ARM32、ARM64 和 MIPS32 架构的 ELF 与 PE 二进制转换为 GTIRB 中间表示。它先解码所有可能指令的超集，再用 Soufflé Datalog 规则和加权启发式推断代码位置、符号化结果和函数边界；gtirb-pprinter 可将结果输出为可重新汇编的汇编代码或重建的二进制，期间还可借助 GTIRB API 或 gtirb-rewriting 修改程序。推断出错时，用户可通过提示文件添加 Datalog 事实或调整启发式权重。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"pince","name":"PINCE","name_zh":"PINCE GDB 前端与内存分析工具","url":"https://github.com/korcankaraokcu/PINCE","evidence_url":"https://github.com/korcankaraokcu/PINCE/blob/9357ba3d8d96477f9bb81e427a97c57f67725c74/README.md","description_en":"Linux front end for the GNU Debugger (GDB), focused on games but usable for other reverse engineering; the name stands for “PINCE is not Cheat Engine”. It scans process memory and pointers through libmemscan into a typed address table, and its memory view adds disassembly, an on-the-fly assembler, code dissection for referenced calls, jumps and strings, function, region and instruction searches, and structure overlays, including structures generated from Mono/IL2CPP class dissection of native Linux or Wine/Proton processes. Debugging covers chained breakpoints and watchpoints, tracking of the instructions that access an address, tracing and stack traces, alongside a GDB console and the reusable libpince Python library.","description_zh":"面向 Linux 的 GNU 调试器（GDB）前端，以游戏为主要对象，也可用于其他逆向工程；名称意为“PINCE is not Cheat Engine”。它借助 libmemscan 扫描进程内存和指针，并将结果放入带类型的地址表；内存视图提供反汇编、即时汇编、对引用的调用、跳转和字符串进行代码剖析、函数/内存区域/指令搜索以及结构体叠加查看，其中结构体可由对原生 Linux 或 Wine/Proton 进程中 Mono/IL2CPP 类的剖析自动生成。调试功能包括可链式关联的断点与观察点、追踪访问某地址的指令、执行跟踪和调用栈查看，并提供 GDB 控制台和可复用的 libpince Python 库。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"uncompyle6","name":"uncompyle6","name_zh":"uncompyle6 跨版本 Python 字节码反编译器","url":"https://github.com/rocky/python-uncompyle6","evidence_url":"https://github.com/rocky/python-uncompyle6/blob/91298ba80e322cfb8736ab8a697509527297a7a9/README.rst","description_en":"Cross-version decompiler that translates Python bytecode back into equivalent Python source, accepting bytecode from Python 1.0 through 3.8 as well as some PyPy bytecode and Dropbox's Python 2.5. It disassembles code objects with the companion xdis library and parses the instruction stream into a grammar-based tree from which source is printed; it can also deparse just the fragment around a given bytecode offset, which the author's trepan debuggers use for exact location reporting. It succeeds the older decompyle, uncompyle and uncompyle2 forks.","description_zh":"跨版本的 Python 反编译器，可把 Python 字节码还原为等价的 Python 源码，支持 Python 1.0 至 3.8 的字节码，以及部分 PyPy 字节码和 Dropbox 的 Python 2.5 字节码。它借助配套的 xdis 库反汇编代码对象，再把指令流解析成基于语法的树并据此输出源码；它还能只反解析给定字节码偏移附近的代码片段，作者的 trepan 调试器即用此功能精确报告位置。它是早期 decompyle、uncompyle 和 uncompyle2 等分支的后继项目。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"ret-sync","name":"ret-sync","name_zh":"ret-sync 调试器与反汇编器同步插件","url":"https://github.com/bootleg/ret-sync","evidence_url":"https://github.com/bootleg/ret-sync/blob/60e7b0fd1bea7bad44da7688801b2bd12fb02040/README.md","description_en":"Reverse-Engineering Tools SYNChronization: plugins that keep IDA, Ghidra or Binary Ninja graph and decompiler views following a live WinDbg, GDB, LLDB, OllyDbg 1.10/2 or x64dbg session, rebasing addresses on the fly so ASLR does not break the mapping. Debugger commands push comments, labels, rebased addresses and command output into the disassembler database and resolve symbols from it, while disassembler hotkeys set breakpoints and step the debugger; several databases can be synced at once and the two sides may run on different hosts. A standalone Python library offers the same position syncing to custom tracing tools.","description_zh":"ret-sync 即“逆向工程工具同步”：一组插件，让 IDA、Ghidra 或 Binary Ninja 的图形与反编译视图跟随运行中的 WinDbg、GDB、LLDB、OllyDbg 1.10/2 或 x64dbg 调试会话，并实时重定基址，使 ASLR 不影响地址对应。调试器命令可将注释、标签、重定基后的地址和命令输出写入反汇编数据库，并从中解析符号；反汇编器中的快捷键则可设置断点、单步执行调试器。可同时同步多个数据库，两端也可运行在不同主机上。独立的 Python 库可为自定义跟踪工具提供同样的位置同步。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"pyinstxtractor","name":"PyInstaller Extractor (pyinstxtractor)","name_zh":"PyInstaller Extractor（pyinstxtractor）PyInstaller 程序提取工具","url":"https://github.com/extremecoders-re/pyinstxtractor","evidence_url":"https://github.com/extremecoders-re/pyinstxtractor/blob/815d31cf26bc71e62f851b2e549452e7b7c9dd98/README.md","description_en":"Single-file Python script that extracts the contents of executables built with PyInstaller, including Linux ELF builds without other tools. It locates the PyInstaller archive in the executable, reports the PyInstaller and Python versions and likely entry-point scripts, and writes out the bundled CArchive files and the modules in the PYZ archive. It fixes the headers of the extracted .pyc files so that Python bytecode decompilers such as uncompyle6 and Decompyle++ (pycdc) recognize them.","description_zh":"单文件 Python 脚本，用于提取由 PyInstaller 构建的可执行文件的内容，Linux ELF 构建也无需借助其他工具即可提取。它在可执行文件中定位 PyInstaller 归档，报告 PyInstaller 和 Python 版本以及可能的入口脚本，并导出打包在 CArchive 中的文件和 PYZ 归档中的模块。它还会修复导出的 .pyc 文件头，使 uncompyle6、Decompyle++（pycdc）等 Python 字节码反编译器能够识别。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"bap","name":"Binary Analysis Platform (BAP)","name_zh":"BAP 二进制分析平台","url":"https://github.com/BinaryAnalysisPlatform/bap","evidence_url":"https://github.com/BinaryAnalysisPlatform/bap/blob/034bbd09646a589d5eb1f10b740177d628da80fd/README.md","description_en":"OCaml binary analysis platform from Carnegie Mellon University. Its bap command loads a program, disassembles it, lifts instructions into an architecture-neutral intermediate representation, builds the control-flow graph and runs analysis passes, while objdump, raw-loader and mc modes handle linear disassembly, raw code blobs and single encodings. The README lists x86, x86-64, ARM, MIPS and PowerPC support, an interpreter, a microexecution interpreter, a symbolic executor and the Primus Lisp language for analyses, function stubs and SMT-solver queries; analyses are written as OCaml plugins or by embedding BAP as a library, with C bindings and minimal Python support in separate repositories.","description_zh":"卡内基梅隆大学开发的 OCaml 二进制分析平台。其 bap 命令可加载程序、进行反汇编、将指令提升为与架构无关的中间表示、构建控制流图并运行分析遍；objdump、raw 加载器和 mc 模式分别用于线性反汇编、原始代码块和单条指令编码。README 列出对 x86、x86-64、ARM、MIPS 和 PowerPC 的支持，以及解释器、微执行解释器、符号执行器和 Primus Lisp 语言，后者可用于编写分析、为函数编写桩模型和调用 SMT 求解器；分析以 OCaml 插件形式编写，或将 BAP 作为库嵌入应用，C 绑定和最基本的 Python 支持位于独立仓库。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"furiousmac-continuity","name":"furiousMAC Continuity","name_zh":"furiousMAC Apple Continuity 协议逆向与解析器","url":"https://github.com/furiousMAC/continuity","evidence_url":"https://github.com/furiousMAC/continuity/blob/d9fa98bddafbfa3baafc84e37a417d78a0598546/README.md","description_en":"Reverse-engineering notes and a Wireshark dissector for Apple's proprietary Continuity Bluetooth LE advertisements, continuing the authors' PETS 2019 privacy study. Per-message pages document field layouts and observed values for 14 message types, including AirDrop, Handoff, Proximity Pairing, Nearby Info and Find My, and the dissector replaces Wireshark's packet-bthci_cmd.c so captured advertisements decode into named btcommon.apple fields.","description_zh":"针对 Apple 专有 Continuity 蓝牙低功耗广播的逆向工程笔记与 Wireshark 解析器，是作者 PETS 2019 隐私研究的延续。各报文页面记录了 AirDrop、Handoff、Proximity Pairing、Nearby Info、Find My 等 14 种报文类型的字段布局和观测到的取值；解析器替换 Wireshark 的 packet-bthci_cmd.c，使捕获到的广播能解码为具名的 btcommon.apple 字段。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"reko","name":"Reko","name_zh":"Reko 通用反编译器","url":"https://github.com/uxmal/reko","evidence_url":"https://github.com/uxmal/reko/blob/63c497aef0f3ea23340b1ed560e51b72fd0d4281/README.md","description_en":"General-purpose decompiler that loads executables or raw images, scans their machine code into a machine-independent register transfer language, groups it into procedures and decompiles them into high-level C code. The reviewed source has 64 architecture directories, from 6502, Z80 and PDP-11 to ARM, MIPS, PowerPC, RISC-V and x86, and loaders for formats including ELF, PE/MZ, Mach-O, COFF, Amiga Hunk, VMS, WebAssembly, Xbox XBE and Xbox 360 XEX. It runs as a Windows Forms GUI, a command-line client or a .NET library, and project files and scripts let users add names, types and comments.","description_zh":"通用反编译器：加载可执行文件或原始镜像，把机器码扫描转换为与机器无关的寄存器传输语言，再归并为过程并反编译为高级 C 代码。所审阅的源码包含 64 个架构目录，从 6502、Z80、PDP-11 到 ARM、MIPS、PowerPC、RISC-V 和 x86，并提供 ELF、PE/MZ、Mach-O、COFF、Amiga Hunk、VMS、WebAssembly、Xbox XBE 及 Xbox 360 XEX 等格式的加载器。可作为 Windows Forms 图形界面、命令行客户端或 .NET 库使用，用户还可通过项目文件和脚本补充名称、类型和注释。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"dyninst","name":"Dyninst","name_zh":"Dyninst 二进制插桩与分析库","url":"https://github.com/dyninst/dyninst","evidence_url":"https://github.com/dyninst/dyninst/blob/0c083894f16d5ea9beb8ad1eea2b60b5c2f95f86/README.md","description_en":"Binary instrumentation, analysis and modification libraries from the Paradyn project. DyninstAPI inserts and changes instrumentation in a running program, or rewrites an executable or library on disk and writes the patched copy back, through one machine-independent interface that also supports static and dynamic analysis. Separately documented components handle symbol tables, line numbers and types (SymtabAPI), instruction decoding and disassembly (InstructionAPI), parsing into blocks, functions and loops (ParseAPI), dataflow analyses such as slicing (DataFlowAPI), process control, stack walking and patching.","description_zh":"源自 Paradyn 项目的二进制插桩、分析与修改库。DyninstAPI 可在运行中的程序里插入和修改插桩代码，也可改写磁盘上的可执行文件或库并写回修改后的副本；同一套与机器无关的接口还支持静态和动态分析。各组件有独立手册，分别负责符号表、行号与类型（SymtabAPI）、指令解码与反汇编（InstructionAPI）、解析为基本块、函数和循环（ParseAPI）、切片等数据流分析（DataFlowAPI），以及进程控制、栈回溯和代码修补。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"goblin","name":"goblin","name_zh":"goblin 二进制格式解析库","url":"https://github.com/m4b/goblin","evidence_url":"https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/README.md","description_en":"Rust crate for zero-copy, endian-aware parsing of ELF32/64, 32/64-bit Mach-O and multi-architecture fat containers, PE32/PE32+, COFF objects, Terse Executable (TE) images and Unix/BSD archives; Object::parse picks the format from its magic bytes. Parsed structures cover ELF headers, sections, symbols, dynamic entries, relocations and notes, Mach-O load commands, imports and exports, and PE imports, exports, relocations, TLS, resources, exception and unwind data, Authenticode certificates and the .NET CLR header. Feature flags can reduce it to std-free #[repr(C)] struct definitions for kernels and other no_std code.","description_zh":"以零拷贝、感知字节序的方式解析二进制格式的 Rust crate，支持 ELF32/64、32/64 位 Mach-O 及多架构 fat 容器、PE32/PE32+、COFF 目标文件、Terse Executable（TE）镜像以及 Unix/BSD 归档；Object::parse 根据魔数自动识别格式。解析结果涵盖 ELF 的文件头、节区、符号、动态段条目、重定位和 note，Mach-O 的加载命令及导入导出，以及 PE 的导入导出、重定位、TLS、资源、异常与展开信息、Authenticode 证书和 .NET CLR 头。借助特性开关，它还可精简为不依赖 std 的 #[repr(C)] 结构体定义，供内核等 no_std 代码使用。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"mitmproxy2swagger","name":"mitmproxy2swagger","name_zh":"mitmproxy2swagger","url":"https://github.com/alufers/mitmproxy2swagger","evidence_url":"https://github.com/alufers/mitmproxy2swagger/blob/f432acafa5907258f0f529ff582c75fefdca00d7/README.md","description_en":"Command-line tool that reverse-engineers undocumented REST APIs from captured traffic. It reads a mitmproxy flow file, or a HAR export from the browser DevTools, and generates an OpenAPI 3.0 specification describing the observed endpoints. Running it again over further captures safely merges the new data into an existing schema.","description_zh":"命令行工具，从捕获的流量还原未公开的 REST API。它读取 mitmproxy 流文件或浏览器 DevTools 导出的 HAR，生成描述所观察端点的 OpenAPI 3.0 规范。对更多捕获再次运行时，会将新数据安全合并到已有规范中。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["protocol","website"],"verified_at":"2026-10-19"},{"id":"opendbc","name":"opendbc","name_zh":"opendbc 汽车 CAN 报文定义库","url":"https://github.com/commaai/opendbc","evidence_url":"https://github.com/commaai/opendbc/blob/48c7f06c6f27c41e7169242acb03ef9775658deb/README.md","description_en":"comma.ai's repository of DBC files describing the CAN messages and signals of many car makes, with a Python library that parses and builds CAN messages from those definitions; its porting guide has contributors reverse engineer new messages from recorded drives in the cabana tool. Per-brand car ports built on it parse vehicle state, identify models from ECU firmware versions and generate openpilot's steering, gas and brake messages, while safety code for comma's panda interface restricts which messages can be sent.","description_zh":"comma.ai 维护的 DBC 文件库，描述多个汽车品牌的 CAN 报文与信号，并附带一个依据这些定义解析和构造 CAN 报文的 Python 库；其车型移植指南要求贡献者在 cabana 工具中利用行车记录逆向分析新的报文。基于它的各品牌车型移植代码可解析车辆状态、根据 ECU 固件版本识别车型，并生成 openpilot 的转向、油门和制动报文；面向 comma panda 接口的安全代码则限制哪些报文可以发出。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"flare-floss","name":"FLOSS (FLARE Obfuscated String Solver)","name_zh":"FLOSS 混淆字符串提取工具","url":"https://github.com/mandiant/flare-floss","evidence_url":"https://github.com/mandiant/flare-floss/blob/e10079080ec5b6fb7584c5331842a94eb4a9b301/README.md","description_en":"Mandiant FLARE string extractor for malware analysis that is used like strings.exe but also recovers obfuscated strings. Besides static ASCII and UTF-16LE strings it extracts stack strings, tight strings and strings decoded by functions: it heuristically identifies decoding routines, recovers their arguments through control-flow analysis, emulates them and diffs memory before and after emulation. It also extracts Go and Rust strings and accepts PE, ELF and raw 32- or 64-bit shellcode; JSON results can be turned into import scripts for IDA Pro, Ghidra, Binary Ninja, radare2 and x64dbg.","description_zh":"Mandiant FLARE 团队的恶意软件字符串提取工具，用法与 strings.exe 相同，但还能还原混淆字符串。除了静态的 ASCII 和 UTF-16LE 字符串，它还能提取栈字符串、紧凑栈字符串（tight strings）以及由函数解码出的字符串：先用启发式方法识别解码函数，通过控制流分析取得调用参数，再模拟执行这些函数，并比较模拟前后的内存状态。它还能提取 Go 和 Rust 字符串，支持 PE、ELF 以及 32 位或 64 位原始 shellcode；JSON 结果可转换为 IDA Pro、Ghidra、Binary Ninja、radare2 和 x64dbg 的导入脚本。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"zydis","name":"Zydis","name_zh":"Zydis x86 反汇编与代码生成库","url":"https://github.com/zyantific/zydis","evidence_url":"https://github.com/zyantific/zydis/blob/a95bb71013436547f689fc0b380f48edf663066e/README.md","description_en":"Lightweight C11 x86/x86-64 disassembler and code-generation library. Its decoder reports each instruction's operands, accessed CPU and FPU flags, ISA set and extension and branch type; the formatter prints Intel, MASM or AT&T syntax, and the encoder assembles instructions from encoder requests, which can also be derived from decoded instructions. ZydisDisasm and ZydisInfo command-line tools are included, and the official Rust and Python 3 bindings live in separate repositories.","description_zh":"轻量级 C11 x86/x86-64 反汇编与代码生成库。解码器可报告每条指令的操作数、所访问的 CPU 与 FPU 标志、ISA 集与扩展以及分支类型；格式化器可输出 Intel、MASM 或 AT&T 语法，编码器则根据编码请求生成指令，请求也可由已解码的指令转换而来。仓库附带 ZydisDisasm 与 ZydisInfo 命令行工具，官方 Rust 与 Python 3 绑定位于独立仓库。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"sony-pmca-re","name":"Sony-PMCA-RE","name_zh":"Sony-PMCA-RE Sony 数码相机逆向工具","url":"https://github.com/ma1co/Sony-PMCA-RE","evidence_url":"https://github.com/ma1co/Sony-PMCA-RE/blob/a82f5baaa8e9c3d9f28f94699e860fb2e48cc8e0/README.md","description_en":"USB tool built from reverse engineering Sony digital cameras. On supported models it reads camera information and installs Android apps through the PlayMemories Camera Apps mechanism, while its firmware-updater and service-mode shells can dump firmware, run Linux commands and change settings. The repository's notes describe the app-installation exchange between the Sony app store, the browser plugin and the camera.","description_zh":"基于逆向 Sony 数码相机而开发的 USB 工具。在受支持的机型上，它可读取相机信息，并借助 PlayMemories Camera Apps 机制安装 Android 应用；其固件更新模式和服务模式下的 shell 可转储固件、执行 Linux 命令并调整设置。仓库中的说明文档记录了 Sony 应用商店、浏览器插件与相机之间的应用安装交互过程。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware","protocol"],"verified_at":"2026-10-19"},{"id":"qbdi","name":"QBDI","name_zh":"QBDI 动态二进制插桩框架","url":"https://github.com/QBDI/QBDI","evidence_url":"https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/README.rst","description_en":"Quarkslab's modular dynamic binary instrumentation (DBI) framework, which JIT-recompiles a program's basic blocks inside its own process so that an instrumentation tool can register callbacks before or after instructions, on memory reads and writes, and on VM events. The engine is a library that can start an instrumented execution anywhere in a process, scripted from C, C++, Python (PyQBDI) or Frida JavaScript. It has no preferred injection method: it bundles the LD_PRELOAD-based QBDIPreload for Linux and macOS dynamic executables and is integrated with Frida.","description_zh":"Quarkslab 开发的模块化动态二进制插桩（DBI）框架：在目标进程内部按基本块对程序进行 JIT 重编译，使插桩工具可以在指令执行前后、内存读写以及虚拟机事件上注册回调。引擎以库的形式提供，可在进程中任意位置启动插桩执行，并可通过 C、C++、Python（PyQBDI）或 Frida JavaScript 编写脚本。它不绑定特定注入方式：自带基于 LD_PRELOAD 的 QBDIPreload，用于 Linux 和 macOS 动态可执行文件，并已与 Frida 集成。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"medusa-framework","name":"MEDUSA","name_zh":"MEDUSA","url":"https://github.com/Ch0pin/medusa","evidence_url":"https://github.com/Ch0pin/medusa/blob/a7bd929f297f0725a5e4d2e3952874a757d4e2fc/README.md","description_en":"Modular Frida-based framework for runtime analysis of Android and iOS apps the analyst is authorized to test. From a single coordinated script it loads plug-in modules to inspect network and WebView activity, trace API calls, examine memory and cryptographic operations, monitor malware behavior, and handle protections such as SSL pinning. The README reports it ships with over 90 reusable modules.","description_zh":"基于 Frida 的模块化框架，用于对分析者有权测试的 Android 与 iOS 应用进行运行时分析。通过单个协调脚本加载插件模块，检查网络与 WebView 活动、跟踪 API 调用、查看内存与加密操作、监控恶意软件行为，并处理 SSL 固定等保护。README 称其内置 90 多个可复用模块。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"binsider","name":"binsider","name_zh":"binsider ELF 二进制分析终端界面","url":"https://github.com/orhun/binsider","evidence_url":"https://github.com/orhun/binsider/blob/7f0633d1a69af15cc3be9e0533cb36dbe67eb598/README.md","description_en":"Terminal user interface for inspecting ELF binaries. It shows file information and linked shared libraries in the manner of stat and ldd, browses ELF headers, notes, sections, segments, symbols, dynamic symbols and relocations much like readelf, extracts strings with an adjustable minimum length, and offers a searchable hexdump view. Optional dynamic analysis runs the binary and traces its system calls like strace, with a summary of time and call counts per system call; the interface can also be embedded as a Rust library in Ratatui applications.","description_zh":"用于查看 ELF 二进制的终端用户界面。它可像 stat 和 ldd 那样显示文件信息和所链接的共享库，像 readelf 那样浏览 ELF 头、注释、节区、段、符号、动态符号和重定位，按可调的最小长度提取字符串，并提供可搜索的十六进制视图。可选的动态分析会运行该二进制，像 strace 那样跟踪其系统调用，并按系统调用汇总耗时和调用次数；该界面还能作为 Rust 库嵌入 Ratatui 应用。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"mytechnotalent-reverse-engineering","name":"Reverse Engineering (mytechnotalent)","name_zh":"逆向工程教程（mytechnotalent）","url":"https://github.com/mytechnotalent/Reverse-Engineering","evidence_url":"https://github.com/mytechnotalent/Reverse-Engineering/blob/8ae661a1cf37fb17afc29981d424f1656dc7741b/README.md","description_en":"A free, English lesson index by mytechnotalent that grows almost daily: 490 numbered lessons, most of which have learners write small programs and then debug and patch (\"hack\") them, across x86, x64, 32/64-bit ARM, RISC-V and AVR. Early courses start from number systems, registers, memory and the stack; later ones cover microcontroller firmware on Raspberry Pi Pico/Pico 2, STM32F401, ESP32-C3, ATmega328P and micro:bit boards, plus Windows, Go, Rust and WebAssembly programs. The README is a table of links; the lesson text lives in a GitBook and in the author's other repositories and PDF books.","description_zh":"mytechnotalent 维护的免费英文课程索引，几乎每天更新：共 490 节编号课程，多数课程让学习者先编写小程序，再对其调试和打补丁（文中称 \"hack\"），覆盖 x86、x64、32/64 位 ARM、RISC-V 和 AVR。前期课程从数制、寄存器、内存和栈讲起；后期转向 Raspberry Pi Pico/Pico 2、STM32F401、ESP32-C3、ATmega328P 和 micro:bit 等开发板上的微控制器固件，以及 Windows、Go、Rust 和 WebAssembly 程序。README 本身只是链接目录，课程正文位于一个 GitBook 以及作者其他仓库中的课程文件和 PDF 书。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"coop-anything","name":"Co-op Anything","name_zh":"Co-op Anything：为单人游戏加入合作模式的智能体手册","url":"https://github.com/cranebeaker/coop-anything","evidence_url":"https://github.com/cranebeaker/coop-anything/blob/bffd56f00bdd6063db13fa59c18a74678b121ca0/README.md","description_en":"Agent playbook, skill set and stdio MCP server for adding online or split-screen co-op to single-player games the players already have installed. Agents either revive an existing co-op mod or reverse engineer the game and engine to build one, test it with in-game bots and send their notes back, while the MCP server searches a directory of 223 co-op projects and 32 open gaps, detects a game’s engine from its install folder and records the executable’s identity. Its README and reverse-engineering skill pair it with REA for native code, and two game write-ups report observations made through REA’s Ghidra lane.","description_zh":"为玩家已安装的单人游戏加入联机或分屏合作模式的智能体操作手册、技能集与 stdio MCP 服务器。智能体或修复已有的合作模组，或逆向分析游戏及其引擎从头实现，再用游戏内机器人测试并把笔记回馈给仓库；MCP 服务器则可检索收录 223 个合作项目和 32 处空缺的目录，根据安装目录识别游戏引擎，并记录可执行文件的身份信息。其 README 和逆向分析技能建议原生代码部分搭配 REA 使用，另有两份游戏笔记报告了借助 REA 的 Ghidra 通道得到的观察结果。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["game"],"verified_at":"2026-10-19"},{"id":"fissure","name":"FISSURE","name_zh":"FISSURE 射频信号分析与协议发现框架","url":"https://github.com/ainfosec/FISSURE","evidence_url":"https://github.com/ainfosec/FISSURE/blob/75abda154a3f0642df00100d847e51d63d186821/README.md","description_en":"GNU Radio-based RF framework that carries a signal from survey and detection through IQ capture, inspection, conditioning, feature extraction and classification into a protocol discovery workflow. Its demodulation workspace estimates symbol rates for OOK/ASK and binary FSK recordings, and the bitstream and framing stage applies Manchester or differential decoding, sync-pattern and CRC evidence and repeated-message detection to propose message boundaries. A Qt dashboard coordinates local or remote SDR sensor nodes, a library keeps protocol and packet definitions, dissectors and archived recordings, and plugins add inspection modules such as radar pulse analysis.","description_zh":"基于 GNU Radio 的射频框架，可将信号从频谱巡查与检测，经 IQ 采集、检查、调理、特征提取和分类，一路带入协议发现流程。其解调工作区可为 OOK/ASK 和二进制 FSK 录制估计符号速率；比特流与成帧阶段则结合曼彻斯特或差分解码、同步模式与 CRC 证据以及重复报文检测，推断报文边界。Qt 仪表盘负责协调本地或远程的 SDR 传感节点，资料库保存协议与数据包定义、解析器和归档录制，插件还可加入雷达脉冲分析等检查模块。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"android-unpinner","name":"Android Unpinner","name_zh":"Android Unpinner","url":"https://github.com/mitmproxy/android-unpinner","evidence_url":"https://github.com/mitmproxy/android-unpinner/blob/60cbfee4d43cedaff622d72c27d87e418a111413/README.md","description_en":"Tool from the mitmproxy project that removes certificate pinning from an Android APK you own or are authorized to test, without a rooted device. It marks the app debuggable, touching only AndroidManifest.xml, and injects a Frida Gadget over ADB so an interception proxy can read the app's traffic, reusing HTTP Toolkit's unpinning script. It bundles the Android SDK helpers it needs and can also handle split APKs delivered as XAPK.","description_zh":"来自 mitmproxy 项目的工具，可在无需 root 的情况下移除使用者拥有或有权测试的 Android APK 的证书固定。它将应用标记为可调试（仅改动 AndroidManifest.xml），并通过 ADB 注入 Frida Gadget，复用 HTTP Toolkit 的解固定脚本，使检查代理能够读取应用流量。工具自带所需的 Android SDK 辅助程序，并可处理以 XAPK 形式提供的分包。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"cpu-rec","name":"cpu_rec","name_zh":"cpu_rec CPU 指令集统计识别工具","url":"https://github.com/airbus-seclab/cpu_rec","evidence_url":"https://github.com/airbus-seclab/cpu_rec/blob/6b192399cd56ad6953e568e1263024dd8a4ef38d/README.md","description_en":"Statistically recognize the CPU instruction set in an arbitrary binary file, such as an unknown firmware image, by comparing Markov-chain byte statistics with a default corpus covering dozens of architectures, from 6502 and 8051 to ARM, MIPS, PowerPC, RISC-V, x86-64 and WebAssembly. It reports a match for the whole file, then the largest chunk that matches one architecture, and shows entropy so that encrypted or compressed regions can be discounted. It runs standalone, as a Python function or as a binwalk module.","description_zh":"对任意二进制文件（例如来历不明的固件镜像）中的 CPU 指令集进行统计识别：把字节的马尔可夫链统计与默认语料库比较，语料库涵盖数十种架构，从 6502、8051 到 ARM、MIPS、PowerPC、RISC-V、x86-64 和 WebAssembly。它先给出整个文件的匹配结果，再找出与单一架构匹配的最大数据块，并显示熵值，以便排除加密或压缩区域。可独立运行，也可作为 Python 函数或 binwalk 模块使用。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"iced","name":"iced","name_zh":"iced x86 指令解码与汇编库","url":"https://github.com/icedland/iced","evidence_url":"https://github.com/icedland/iced/blob/8cfc5f57c08fd2e80a4cec9d3d9d36f642b2de31/README.md","description_en":"x86 instruction library for 16-, 32- and 64-bit code that decodes, formats, assembles and encodes instructions, with masm, nasm, GNU AT&T and Intel XED output syntaxes. Its instruction-info API reports the registers, memory operands and RFLAGS bits an instruction reads or writes, its CPUID feature flags and control-flow type, and the encoder can re-encode decoded instructions at any address. Rust, C# (.NET) and Java implementations live in one repository, with Python, JavaScript (WebAssembly) and Lua bindings built on the Rust crate.","description_zh":"面向 16、32 和 64 位 x86 代码的指令库，可解码、格式化、汇编和编码指令，输出支持 masm、nasm、GNU AT&T 和 Intel XED 语法。其指令信息 API 可报告指令读写的寄存器、内存操作数和 RFLAGS 标志位，以及所需的 CPUID 特性标志和控制流类型；编码器还能把已解码的指令重新编码到任意地址。同一仓库维护 Rust、C#（.NET）和 Java 三套实现，另有基于 Rust crate 的 Python、JavaScript（WebAssembly）和 Lua 绑定。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"apk-mitm","name":"apk-mitm","name_zh":"apk-mitm","url":"https://github.com/niklashigi/apk-mitm","evidence_url":"https://github.com/niklashigi/apk-mitm/blob/5a96363fc9112b97d60fc2bd3799d6bbfd8e4e00/README.md","description_en":"Command-line tool that prepares an Android APK you own or are authorized to test for HTTPS traffic inspection. It decodes the package with Apktool, adjusts the network security configuration to trust user-added certificates, disables certificate pinning, then re-encodes and signs the patched APK, so a proxy can read the app's traffic without a rooted device. App bundles supplied as .xapk or .apks are also supported.","description_zh":"命令行工具，为使用者拥有或有权测试的 Android APK 准备 HTTPS 流量检查。它用 Apktool 解码安装包、调整网络安全配置以信任用户添加的证书、关闭证书固定，再重新编码并签名修补后的 APK，使代理无需 root 设备即可读取应用流量。也支持以 .xapk 或 .apks 形式提供的应用捆绑包。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"fritap","name":"friTap","name_zh":"friTap TLS 密钥提取与流量解密工具","url":"https://github.com/fkie-cad/friTap","evidence_url":"https://github.com/fkie-cad/friTap/blob/d7398a153755c136005e932414592885348cf83d/README.md","description_en":"Frida-based tool that hooks TLS libraries such as OpenSSL, BoringSSL, NSS and GnuTLS inside a running process and writes NSS key logs and decrypted payloads as PCAP, so analysts can inspect an application's encrypted traffic in Wireshark. For stripped or statically linked libraries it accepts byte patterns or offsets and can scan for renamed libraries, or it can recover TLS secrets by scanning heap memory instead of hooking. A terminal UI, a Python API and a Wireshark extcap integration wrap the same capture.","description_zh":"基于 Frida 的工具，在运行中的进程内挂钩 OpenSSL、BoringSSL、NSS、GnuTLS 等 TLS 库，输出 NSS 格式的密钥日志和解密后的 PCAP 明文，便于分析者在 Wireshark 中检查应用的加密流量。对于去除符号或静态链接的库，可通过字节模式或偏移量定位函数、扫描被重命名的库，也可不挂钩而改为扫描堆内存来恢复 TLS 密钥。终端界面、Python API 和 Wireshark extcap 集成都基于同一套捕获功能。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"hrtng","name":"hrtng","name_zh":"hrtng IDA 反编译增强插件","url":"https://github.com/KasperskyLab/hrtng","evidence_url":"https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/README.md","description_en":"IDA plugin published by Kaspersky that extends the Hex-Rays decompiler with tools its author collected for reverse-engineering work, including malware analysis. It decrypts strings, data and constants with built-in ciphers or in bulk through IDA's Appcall debugger feature, resolves API-name hashes, unflattens control flow and forces decompilation of obfuscated code, and recognizes library code through microcode signatures, inlined-function detection and PAT files built from an IDA database. Pseudocode helpers cover automatic renaming, retyping and enum substitution, structure creation, virtual and indirect call navigation, and patching.","description_zh":"Kaspersky 发布的 IDA 插件，为 Hex-Rays 反编译器加入了作者在包括恶意软件分析在内的逆向工作中积累的各类工具。它可用内置密码算法解密字符串、数据和常量，或借助 IDA 的 Appcall 调试器功能批量解密；还能识别 API 名称哈希、消除控制流平坦化并强制反编译混淆代码，并通过微码签名、内联函数检测和从 IDA 数据库生成的 PAT 文件识别库代码。伪代码辅助功能包括自动重命名、类型修改和枚举替换、结构体创建、虚函数与间接调用导航以及补丁。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"frida-interception-and-unpinning","name":"Frida Mobile Interception Scripts","name_zh":"Frida 移动端拦截脚本","url":"https://github.com/httptoolkit/frida-interception-and-unpinning","evidence_url":"https://github.com/httptoolkit/frida-interception-and-unpinning/blob/560dd29d410fe785f9f390e3c7f86ca8359c8d67/README.md","description_en":"A set of Frida scripts from HTTP Toolkit for inspecting a mobile app's HTTPS traffic while analysing apps you own or are authorized to test. Injected into a running Android or iOS app, they redirect its connections to an interception proxy, add a user-supplied CA certificate to the trust stores, and disable certificate pinning and transparency checks so the proxy can read the traffic. Individual scripts can also be used on their own to hook specific behaviour.","description_zh":"来自 HTTP Toolkit 的一组 Frida 脚本，用于在分析自有或经授权测试的应用时检查移动应用的 HTTPS 流量。将其注入运行中的 Android 或 iOS 应用后，可把连接重定向到检查代理、将用户提供的 CA 证书加入信任库，并关闭证书固定与证书透明度检查，使代理能够读取流量。各脚本也可单独使用以挂钩特定行为。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"bincat","name":"BinCAT","name_zh":"BinCAT 二进制静态分析工具包","url":"https://github.com/airbus-seclab/bincat","evidence_url":"https://github.com/airbus-seclab/bincat/blob/5d0ee3b56867059427eb0f4123c4d9de0b8059dd/README.md","description_en":"Static binary code analysis toolkit designed for reverse engineers. Starting from a chosen address and initial state, it computes register and memory values, taint and reconstructed types, with forward and backward analysis and heap use-after-free and double-free detection; bits it cannot determine are shown as unknown. It is driven from an IDA plugin, where analysts can override values or taint, skip functions or replace instructions with NOPs before re-running, or from Python and an .ini configuration for automation.","description_zh":"面向逆向工程人员的二进制代码静态分析工具包。它从选定的地址和初始状态出发，计算寄存器与内存的值、污点和重建出的类型，支持前向与后向分析，并能检测堆上的释放后使用和重复释放；无法确定的位会标为未知。分析可在 IDA 插件中进行，分析人员可覆盖值或污点、跳过函数或把指令替换为 NOP 后重新运行；也可通过 Python 和 .ini 配置文件实现自动化。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"pbtk","name":"pbtk","name_zh":"pbtk Protobuf 逆向工具集","url":"https://github.com/marin-m/pbtk","evidence_url":"https://github.com/marin-m/pbtk/blob/7c5fa2ca4cee9e8a2862c6e3332e7b8a850bb8e8/README.md","description_en":"Recover Protobuf message definitions from compiled programs as readable .proto files. Extractors cover the Java runtimes in JAR, DEX and APK files (including ProGuard-obfuscated code), binaries that embed Protobuf reflection metadata, and web apps using the Protobuf-URL format. A GUI then binds a recovered message type to an HTTP endpoint, decodes hex-encoded captured samples into an editable field tree and resends edited messages, so analysts can relate each field to the response.","description_zh":"从已编译程序中恢复 Protobuf 消息定义，并还原为可读的 .proto 文件。提取器覆盖 JAR、DEX 和 APK 中的各类 Java 运行时（包括经 ProGuard 混淆的代码）、内嵌 Protobuf 反射元数据的二进制文件，以及使用 Protobuf-URL 格式的 Web 应用。随后可在图形界面中把恢复出的消息类型绑定到 HTTP 端点，将十六进制形式的抓包样本解码为可编辑的字段树，并重新发送修改后的消息，帮助分析者把每个字段与响应对应起来。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"reflutter","name":"reFlutter","name_zh":"reFlutter","url":"https://github.com/Impact-I/reFlutter","evidence_url":"https://github.com/Impact-I/reFlutter/blob/846a00033ef39a53502eed8b775b6699fe0fc684/README.md","description_en":"Flutter reverse-engineering framework for apps the analyst is authorized to inspect. It repacks an app with a prebuilt patched Dart engine, or instruments the app's own engine at runtime, to emit a JSONL dump of every function's name, class, library and code offset into the Dart instructions image for Frida or IDA/Ghidra work. It can also route the app's HTTPS traffic through an inspection proxy with Flutter certificate pinning disabled.","description_zh":"面向分析者有权检查的应用的 Flutter 逆向框架。它通过替换为预编译的已打补丁 Dart 引擎（repack 模式）或在运行时插桩应用自带引擎（attach 模式），导出包含每个函数名称、类、库以及其在 Dart 指令镜像中代码偏移的 JSONL 清单，供 Frida 或 IDA/Ghidra 使用。它还能在关闭 Flutter 证书固定的情况下，将应用的 HTTPS 流量路由到检查代理。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"ddc","name":"ddc","name_zh":"ddc Android DEX 反编译器","url":"https://github.com/ejfkdev/ddc","evidence_url":"https://github.com/ejfkdev/ddc/blob/e240550669fed51edc8d373654b1883322a60eec/README.md","description_en":"Rust decompiler that turns Android DEX bytecode, versions 035 to 041, from APKs, multi-dex apps and XAPK/APKS/APKM containers into Java, folding lambdas and string concatenation back into Java syntax and giving locals jadx-style names. By default every file also goes through a source-level cleanup pass, described as semantics-preserving, that inlines copy chains, recovers ternaries and for-each loops and drops dead stores; --fast skips it. Alongside full decompilation, 15 query subcommands return app and manifest information, resources, strings, cross-references, class hierarchies, disassembly or single classes and methods on demand, and the same queries are served over REST and MCP.","description_zh":"用 Rust 编写的反编译器，可将 APK、多 DEX 应用以及 XAPK/APKS/APKM 容器中 035 至 041 版本的 Android DEX 字节码转换为 Java，把 lambda 和字符串拼接还原为 Java 语法，并按 jadx 的风格为局部变量命名。默认情况下，每个文件还会经过一道据称保持语义的源码级整理，内联拷贝链、恢复三元表达式和 for-each 循环并删除无用赋值；--fast 可跳过这一步。除完整反编译外，15 个查询子命令可按需返回应用与清单信息、资源、字符串、交叉引用、类层次结构、反汇编以及单个类或方法，同样的查询也可通过 REST 和 MCP 提供。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"me-analyzer","name":"ME Analyzer","name_zh":"ME Analyzer Intel 引擎与图形固件分析工具","url":"https://github.com/platomav/MEAnalyzer","evidence_url":"https://github.com/platomav/MEAnalyzer/blob/d27ccdba0aadbad490f47b5b631c369b682a7ef5/README.md","description_en":"Parse Intel Management Engine (CS)ME, TXE and SPS firmware, Graphics System Controller firmware and their independent PMC, PCHC, PHY and option-ROM images to report family, version, release, SKU, platform, size and health status. Research options print flash partition, BPDT/IFWI and CSE layout tables, validate RSA signatures and checksums, and unpack the supported CSE and GSC code and file systems. A bundled database identifies known images and reports those not yet listed in the community firmware repositories.","description_zh":"解析 Intel 管理引擎 (CS)ME、TXE 和 SPS 固件、图形系统控制器（GSC）固件，以及与之配套的独立 PMC、PCHC、PHY 和 Option ROM 镜像，报告系列、版本、发布类型、SKU、平台、大小和健康状态。研究用参数可显示 Flash 分区表、BPDT/IFWI 和 CSE 布局表，校验 RSA 签名与校验和，并解包所支持的 CSE、GSC 代码及文件系统。附带的数据库能识别已知镜像，并报告社区固件仓库尚未收录的镜像。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"deepextract-ida","name":"DeepExtract (DeepExtractIDA)","name_zh":"DeepExtract：把 PE 文件导出给 AI 智能体的 IDA 插件","url":"https://github.com/marcosd4h/DeepExtractIDA","evidence_url":"https://github.com/marcosd4h/DeepExtractIDA/blob/af6b01df3ce5774016f6e3cf336ed0ca2f47b512/README.md","description_en":"IDA Pro 9.x plugin and PowerShell batch extractor that turn Windows PE files into material AI coding agents can read: a per-binary SQLite database of PE metadata, signatures, disassembly, Hex-Rays pseudocode, cross-references, strings, stack frames, loops and dangerous API calls, plus optional grouped C++ and assembly files with per-function caller, callee and string headers and JSON indexes. It runs headless over directories, file lists or the modules of a running process, or interactively on the open IDA database, keeping the analyst’s renames and comments. The agent commands that work on this output come from the separate DeepExtractRuntime project.","description_zh":"IDA Pro 9.x 插件与 PowerShell 批量提取脚本，可把 Windows PE 文件转换为 AI 编程智能体能够读取的材料：每个二进制文件对应一个 SQLite 数据库，内含 PE 元数据、函数签名、反汇编、Hex-Rays 伪代码、交叉引用、字符串、栈帧、循环与危险 API 调用；还可选择输出分组的 C++ 与汇编文件，每个函数附带调用者、被调者与字符串信息头，并生成 JSON 索引。它可以无界面地处理目录、文件列表或正在运行进程加载的模块，也可以在已打开的 IDA 数据库上交互运行，并保留分析者所做的重命名和注释。处理这些输出的智能体命令来自独立的 DeepExtractRuntime 项目。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"simplify-android-deobfuscator","name":"Simplify","name_zh":"Simplify Android 反混淆工具","url":"https://github.com/CalebFenton/simplify","evidence_url":"https://github.com/CalebFenton/simplify/blob/29fb25d624aecf0b075dea5c6029b2541474ddfe/README.md","description_en":"Generic Android deobfuscator built on smalivm, a sandboxed Dalvik virtual machine that executes each method and records every possible register and class value along all execution paths, taking both branches when a value such as file or network input is unknown. Simplify then repeatedly applies constant propagation, dead-code removal, unreflection and peephole optimizations to the APK or DEX, which can decrypt strings and remove reflection while keeping behaviour the same; it does not rename classes or methods. smalivm can also be used as a library, and the last release adds sdbg, a step-through Smali debugger built on it.","description_zh":"基于 smalivm 的通用 Android 反混淆工具。smalivm 是一个沙箱化的 Dalvik 虚拟机，会逐个执行方法并记录所有执行路径上可能的寄存器与类取值；遇到文件或网络输入等未知值时，两个分支都会执行。Simplify 随后对 APK 或 DEX 反复进行常量传播、死代码删除、反射还原和窥孔优化，可在保持行为不变的前提下解密字符串、去除反射；它不会重命名类或方法。smalivm 也可作为库使用，最新发布版还附带基于它的单步 Smali 调试器 sdbg。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"gda-android-decompiler","name":"GDA (GJoy Dex Analyzer)","name_zh":"GDA Android 反编译器","url":"https://github.com/charles2gan/GDA-android-reversing-Tool","evidence_url":"https://github.com/charles2gan/GDA-android-reversing-Tool/blob/20f8ce8d51b0dc032c08e009e28ea76995d71889/README.md","description_en":"Windows-native Dalvik decompiler and Android analysis workbench written in C++ that opens APK, DEX, ODEX, OAT, JAR, AAR and class files without installation. Besides Java and Smali views with cross-references, renaming and comments, it identifies packers, deobfuscates and decrypts strings, tracks data flow and taint, solves paths, runs rule-based malicious-behaviour, vulnerability and privacy-leak scans, and can dump device memory or hook methods with Frida. Shell and server CLI modes, Python and Java scripting and a sample malware-triage agent skill expose the same analysis to scripts and agents.","description_zh":"以 C++ 编写、原生运行于 Windows 的 Dalvik 反编译器与 Android 分析工作台，无需安装即可打开 APK、DEX、ODEX、OAT、JAR、AAR 和 class 文件。除带交叉引用、重命名和注释的 Java 与 Smali 视图外，它还能识别加固壳、反混淆并解密字符串、追踪数据流与污点、求解路径，运行基于规则的恶意行为、漏洞和隐私泄露扫描，并可转储设备内存或用 Frida 钩挂方法。Shell 与服务器两种命令行模式、Python 和 Java 脚本以及一个恶意软件分诊智能体技能示例，让脚本和智能体也能调用这些分析功能。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"gef","name":"GEF (GDB Enhanced Features)","name_zh":"GEF GDB 增强扩展","url":"https://github.com/hugsy/gef","evidence_url":"https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/README.md","description_en":"Single-file Python extension, gef.py, that adds dynamic-analysis commands to GDB. Each stop shows a context view of registers, stack, code, threads and call trace, and commands cover memory maps, pointer dereferencing, searching process memory for patterns, ELF and security-property information, process status and glibc heap inspection. An architecture abstraction layer covers x86-32/64, ARMv5–v7, AArch64, SPARC, MIPS and PowerPC, and gef-remote enriches remote sessions through gdbserver or the GDB stubs of qemu-user and qemu-system.","description_zh":"单文件 Python 扩展 gef.py，为 GDB 增加动态分析命令。每次程序停下时都会显示寄存器、栈、代码、线程和调用轨迹等上下文视图，命令涵盖内存映射、指针解引用、在进程内存中搜索模式、ELF 与安全属性信息、进程状态以及 glibc 堆检查。其架构抽象层覆盖 x86-32/64、ARMv5–v7、AArch64、SPARC、MIPS 和 PowerPC；gef-remote 命令可通过 gdbserver 或 qemu-user、qemu-system 的 GDB stub 增强远程调试会话。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"z0f-reverse-engineering-course","name":"Z0FCourse Reverse Engineering","name_zh":"Z0FCourse 逆向工程课程","url":"https://github.com/0xZ0F/Z0FCourse_ReverseEngineering","evidence_url":"https://github.com/0xZ0F/Z0FCourse_ReverseEngineering/blob/ee4b07095d6f81ba5e5c7e0b70f7cb39e3af83b1/README.md","description_en":"A free English course by Z0F on reverse engineering 64-bit Windows programs, which its README pitches as taking learners from beginner to intermediate. Markdown lessons move from number systems, x64 registers, memory layout and calling conventions to x64dbg and Ghidra, then reverse small samples and an author-written DLL, recovering a Player class and calling the DLL's exports from a program of one's own. The unfinished later chapters introduce Windows internals and reverse ntdll's generic-table functions.","description_zh":"Z0F 编写的免费英文课程，讲解如何逆向 64 位 Windows 程序，README 称目标是帮助学习者从入门进阶到中级。Markdown 课程从数制、x64 寄存器、内存布局和调用约定讲起，过渡到 x64dbg 与 Ghidra，再逆向若干小样本以及作者自己编写的 DLL，还原其中的 Player 类，并在自己编写的程序中调用该 DLL 的导出函数。尚未完成的后续章节介绍 Windows 内部机制，并逆向 ntdll 中的 generic table 系列函数。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"apklab","name":"APKLab","name_zh":"APKLab Android 逆向工作台","url":"https://github.com/APKLab/APKLab","evidence_url":"https://github.com/APKLab/APKLab/blob/6ae69b1ba03d65cb78388f7e2fa6a3b8f0081c74/README.md","description_en":"VS Code extension that turns the editor into an Android reverse-engineering workbench around Apktool, Jadx, smali-lsp and uber-apk-signer. It decodes an APK into resources and Smali, decompiles it to Java, gives Smali go-to-definition, references and diagnostics through a language server, and rebuilds, signs and installs the modified app. It can also generate Frida hooks for Smali methods, add a Frida gadget, prepare an app for HTTPS traffic inspection with apk-mitm and produce a Quark-Engine malware-analysis report.","description_zh":"把 VS Code 变成 Android 逆向工作台的扩展，整合 Apktool、Jadx、smali-lsp 和 uber-apk-signer。它可将 APK 解码为资源文件和 Smali 并反编译为 Java，借助语言服务器为 Smali 提供定义跳转、引用查找和诊断，还能重新构建、签名并安装修改后的应用。此外，它可为 Smali 方法生成 Frida 钩子、加入 Frida gadget、借助 apk-mitm 为 HTTPS 流量检查做准备，并生成 Quark-Engine 恶意软件分析报告。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"triton","name":"Triton","name_zh":"Triton 动态二进制分析库","url":"https://github.com/JonathanSalwan/Triton","evidence_url":"https://github.com/JonathanSalwan/Triton/blob/bc84cf745e99768e07d51dcd734eba35c59f1b3e/README.md","description_en":"C++ library with Python bindings for dynamic binary analysis of x86, x86-64, ARM32, AArch64 and RISC-V 32/64 code. Callers process instructions one at a time, optionally with concrete register and memory values; Triton builds symbolic expressions from each instruction's semantics, tracks taint and solves path constraints through Z3 or Bitwuzla. It also synthesizes and simplifies expressions and lifts them to LLVM IR or Z3 and back, for building analysis tools, automating reverse engineering, software verification or emulating code.","description_zh":"面向 x86、x86-64、ARM32、AArch64 和 RISC-V 32/64 代码动态二进制分析的 C++ 库，提供 Python 绑定。调用方逐条处理指令，并可设置具体的寄存器和内存值；Triton 依据每条指令的语义构建符号表达式、进行污点跟踪，并通过 Z3 或 Bitwuzla 求解路径约束。它还能合成与化简表达式，并将其提升为 LLVM IR 或 Z3 表达式后再转换回来，可用于构建分析工具、自动化逆向工程、软件验证或模拟执行代码。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"pylingual","name":"PyLingual","name_zh":"PyLingual Python 字节码反编译器","url":"https://github.com/syssec-utd/pylingual","evidence_url":"https://github.com/syssec-utd/pylingual/blob/509ea92e560b2c2c99b0c9901bd33e404fbfb4b8/README.md","description_en":"Research decompiler for CPython bytecode from Python 3.6 onward that pairs per-version transformer models with control-flow reconstruction. A segmentation model splits bytecode into statements, a statement model translates each into source, and templates rebuild loops, conditionals, exception handlers, with blocks and match statements. The result is recompiled with the target Python version and its control flow compared with the original bytecode, and failing segments are retried with alternative segmentations; the design is described in the IEEE S&P 2025 paper “PyLingual: Toward Perfect Decompilation of Evolving High-Level Languages”.","description_zh":"面向 Python 3.6 及以后版本 CPython 字节码的研究型反编译器，将按版本训练的 Transformer 模型与控制流重建相结合。分段模型把字节码切分为语句，语句模型将每段翻译为源码，再由模板重建循环、条件分支、异常处理、with 块和 match 语句。生成结果会用目标 Python 版本重新编译，并与原字节码比较控制流，未通过的片段会改用其他分段方案重试；其设计见 IEEE S&P 2025 论文《PyLingual: Toward Perfect Decompilation of Evolving High-Level Languages》。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"sf64-matching-decomp-case","name":"Star Fox 64: a complete matching Nintendo 64 decompilation","name_zh":"《星际火狐 64》：完整的 Nintendo 64 版一致性反编译","url":"https://github.com/sonicdcer/sf64","evidence_url":"https://github.com/sonicdcer/sf64/blob/4235c59f00b04440e3fd5fec49f0bc80e48cf212/README.md","description_en":"Reconstructs C source for the US 1.1 (Rev A) Nintendo 64 release of Star Fox 64 that, compiled with the IDO compiler through a static recompilation, rebuilds a ROM with the published MD5; the README badge counts all 2,951 functions as matching. Code and assets are split from the user’s own ROM at build time, and the repository contains no assets or assembly. The separately curated Starship PC port compiles this C code, while Starfox 64: Recompiled takes headers and some functions from it for its patches.","description_zh":"为 Nintendo 64 版《星际火狐 64》美版 1.1（Rev A）重建 C 源码；借助静态重编译运行的 IDO 编译器编译后，可重建出 MD5 与公布值一致的 ROM，README 徽章显示全部 2,951 个函数均已一致。构建时从使用者自备的 ROM 中拆分代码与素材，仓库本身不含素材或汇编。另行收录的 Starship PC 移植直接编译这份 C 代码，Starfox 64: Recompiled 则从中取用头文件和部分函数来编写补丁。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"galaxy-buds-client-protocol-case","name":"Galaxy Buds Client: an unofficial manager built on Samsung’s earbud protocol","name_zh":"Galaxy Buds Client：基于三星耳机协议的非官方管理器","url":"https://github.com/timschneeb/GalaxyBudsClient","evidence_url":"https://github.com/timschneeb/GalaxyBudsClient/blob/754b6fdfb1c151b022cece775c8aaad4eb185afa/README.md","description_en":"Reimplements control of Samsung Galaxy Buds over their proprietary RFCOMM serial protocol in a cross-platform desktop and Android manager. The author reports recovering the message format by analyzing the earbuds’ binary stream and disassembling Samsung’s official Android apps, and publishes partial packet notes for the 2019 Buds and the Buds+. Beyond the official app’s settings, it exposes battery statistics, diagnostics, factory self-tests, hidden debug information and firmware flashing for supported models.","description_zh":"在跨平台桌面与 Android 管理器中，通过三星 Galaxy Buds 专有的 RFCOMM 串口协议重新实现耳机控制。作者称通过分析耳机发出的二进制数据流并反汇编三星官方 Android 应用来恢复报文格式，并公开了 2019 款 Buds 和 Buds+ 的部分数据包笔记。除官方应用的设置外，它还提供电池统计、诊断、出厂自检、隐藏调试信息，以及适用型号的固件刷写。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"owasp-mastg","name":"OWASP Mobile Application Security Testing Guide (MASTG)","name_zh":"OWASP 移动应用安全测试指南（MASTG）","url":"https://mas.owasp.org/MASTG/","evidence_url":"https://github.com/OWASP/mastg/blob/02ffd85fb74383ec2a30b42866d38f89d72c0ead/README.md","description_en":"OWASP’s open manual for Android and iOS app security testing and reverse engineering, published at mas.owasp.org. Chapters on platform internals, test setup and app tampering and reverse engineering sit beside modular, individually referenced tests, techniques, tool pages, knowledge articles, best practices and runnable demos, all mapped to MASVS controls and MASWE weaknesses. OWASP’s UnCrackable crackme apps serve as practice targets and examples.","description_zh":"OWASP 维护的开放手册，讲解 Android 和 iOS 应用的安全测试与逆向工程，发布于 mas.owasp.org。除平台原理、测试环境搭建以及应用篡改与逆向工程等章节外，还收录可单独引用的测试、技术、工具页面、知识条目、最佳实践和可运行的演示，均与 MASVS 控制项和 MASWE 弱点对应。OWASP 自己的 UnCrackable 破解练习应用用作练习目标和示例。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app"],"verified_at":"2026-10-19"},{"id":"wino-mail-case","name":"Wino Mail: recreating Windows Mail and Calendar","name_zh":"Wino Mail：重建 Windows 邮件与日历体验","url":"https://github.com/bkaankose/Wino-Mail","evidence_url":"https://github.com/bkaankose/Wino-Mail/blob/72b8d56881789ab11e42c9ab41b6567db1b85cde/README.md","description_en":"Native Windows client that aims to preserve the familiar Windows Mail and Calendar experience while rebuilding its functionality. The upstream README documents a WinUI 3 interface, mail and calendar providers, contacts, tasks and offline workflows.","description_zh":"原生 Windows 客户端，以重建 Windows 邮件与日历的功能、保留熟悉的使用体验为目标。上游 README 说明了 WinUI 3 界面、邮件与日历服务、联系人、待办及离线工作流。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-18"},{"id":"primedecomp-metroid-prime-decomp-case","name":"Metroid Prime: the PrimeDecomp matching GameCube decompilation","name_zh":"《密特罗德 Prime》：PrimeDecomp 的 GameCube 版一致性反编译","url":"https://github.com/PrimeDecomp/prime","evidence_url":"https://github.com/PrimeDecomp/prime/blob/2fd31790998c0486744a6289cac7e2fecc22d143/README.md","description_en":"Reconstructs C++ source for Metroid Prime’s GameCube executable and its NES-emulator module so that CodeWarrior builds match the originals, across the USA, Korean, PAL and Japanese releases, with early configurations for demo discs and three Wii releases. Matched units are compiled from source and linked with objects split from the user’s disc, then checked against per-version SHA-1 hashes; the repository contains no game assets or assembly. The separately curated Metaforce and Metroid Prime Port build their native ports on this code.","description_zh":"为《密特罗德 Prime》GameCube 版的可执行文件及其 NES 模拟器模块重建 C++ 源码，使 CodeWarrior 编译结果与原文件一致，涵盖美版、韩版、PAL 版与日版，另有针对体验版光盘和三个 Wii 版本的早期配置。已匹配的单元由源码编译，再与从使用者光盘中拆分出的对象链接，并按各版本的 SHA-1 哈希校验；仓库不含游戏素材或汇编。另行收录的 Metaforce 与 Metroid Prime Port 都在这份代码之上构建原生移植。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"batla-3d-server-emulator-case","name":"Batla 3D server emulator (2015 client)","name_zh":"Batla 3D 服务端模拟器（2015 年客户端）","url":"https://github.com/Serega25511s/Batla-3D-server-emu","evidence_url":"https://github.com/Serega25511s/Batla-3D-server-emu/blob/c70f254ee86b3fa7363b5afb98541bcaa9e6c751/README.md","description_en":"C# server emulator for the 2015 Steam client of Batla 3D, covering HTTP account, shop and room services and Lidgren UDP gameplay. It includes a client-assembly patcher and protocol notes that distinguish recovered client evidence from emulator rules.","description_zh":"面向 Batla 3D 2015 年 Steam 客户端的 C# 服务端模拟器，涵盖账户、商店、房间 HTTP 服务与 Lidgren UDP 对战。项目包含客户端程序集补丁工具，协议文档区分了从客户端恢复的证据与模拟器自行选择的规则。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game","protocol"],"verified_at":"2026-10-19"},{"id":"decompilation-wiki","name":"The Decompilation Wiki","name_zh":"Decompilation Wiki 反编译维基","url":"https://decompilation.wiki/","evidence_url":"https://github.com/mahaloz/decompilation-wiki/blob/0133d7124ea65d0eb717ff9a01c01b28923d2ca2/README.md","description_en":"Community wiki explaining how decompilers work, from disassembly, lifting and control-flow recovery to type recovery, control-flow structuring, quality evaluation and neural decompilation, citing the research behind each technique. It also keeps directories of decompilers, plugins, blogs and talks, pages on applied research such as symbol recovery, code similarity and vulnerability discovery, and a table of about 240 game reconstruction projects by original platform.","description_zh":"社区维护的维基，讲解反编译器如何工作，从反汇编、提升和控制流恢复，到类型恢复、控制流结构化、质量评估和神经反编译，并为各项技术注明研究出处。它还整理了反编译器、插件、博客和演讲目录，设有符号恢复、代码相似性和漏洞发现等应用研究页面，以及按原平台列出的约 240 个游戏重建项目表。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"rsdkv4-sonic-1-2-decomp-case","name":"RSDKv4 Decompilation: Retro Engine v4 and the Sonic 1 & 2 (2013) menus","name_zh":"RSDKv4 Decompilation：Retro Engine v4 与《索尼克》1、2（2013）菜单的反编译","url":"https://github.com/RSDKModding/RSDKv4-Decompilation","evidence_url":"https://github.com/RSDKModding/RSDKv4-Decompilation/blob/a7f5195e21fdad7b75e4587e249013feeea9e6f3/README.md","description_en":"Decompiles Retro Engine (RSDK) v4, the engine behind Sonic the Hedgehog and Sonic the Hedgehog 2 (2013), together with the games’ natively coded menus, and builds it for Windows, Linux and Android. The engine runs the game scripts contained in the official releases’ data files, which users must supply. The project adds a script compiler, a mod loader and an experimental online mode for Sonic 2’s 2P VS; it is the predecessor of the same group’s RSDKv5 decompilation.","description_zh":"反编译 Retro Engine（RSDK）v4——《索尼克》与《索尼克 2》（2013）所用的引擎——以及两款游戏中以原生代码实现的菜单，可构建 Windows、Linux 与 Android 版本。引擎运行官方发行版数据文件中的游戏脚本，这些文件需由使用者自备。项目增加了脚本编译器、模组加载器，以及《索尼克 2》双人对战的实验性联网模式；它是同一团队 RSDKv5 反编译项目的前身。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"miasm","name":"Miasm","name_zh":"Miasm 逆向工程框架","url":"https://github.com/cea-sec/miasm","evidence_url":"https://github.com/cea-sec/miasm/blob/3671fc24d6e625c2d75f3311724eb6b0c97664f8/README.md","description_en":"Python reverse-engineering framework for analyzing, modifying and generating binary programs. It reads, modifies and generates 32- and 64-bit PE and ELF files, assembles and disassembles x86, ARM, AArch64, MIPS, PowerPC, SH4, MSP430 and MeP code, and lifts it into its own intermediate language for symbolic execution, SSA and data-flow analysis, dependency graphs and expression simplification aimed at deobfuscation. Its JIT emulator runs shellcode or parts of binaries through LLVM, GCC, Clang or pure-Python backends, with Python callbacks that stand in for library functions, sandboxes with selected Windows API and Linux emulation, and dynamic symbolic execution through Z3.","description_zh":"用于分析、修改和生成二进制程序的 Python 逆向工程框架。它可读取、修改和生成 32 位与 64 位 PE 和 ELF 文件，汇编和反汇编 x86、ARM、AArch64、MIPS、PowerPC、SH4、MSP430 与 MeP 代码，并将其提升到自有的中间语言，用于符号执行、SSA 与数据流分析、依赖图以及面向反混淆的表达式化简。其 JIT 模拟器可借助 LLVM、GCC、Clang 或纯 Python 后端运行 shellcode 或二进制中的部分代码，用 Python 回调代替库函数，提供模拟部分 Windows API 和 Linux 行为的沙箱，并可通过 Z3 进行动态符号执行。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"fernflower","name":"Fernflower","name_zh":"Fernflower Java 反编译器","url":"https://github.com/JetBrains/fernflower","evidence_url":"https://github.com/JetBrains/fernflower/blob/924b60f87d93743ab63b59454eec708e8309ef2a/README.md","description_en":"JetBrains' analytical decompiler that turns Java class files back into Java source; IntelliJ IDEA bundles it to show code when debugging or browsing class files. The standalone console decompiler takes class files, JARs, ZIPs or directories, can load library files with -e only as analysis context, and writes Java sources to an output directory. Options cover generic signatures, lambdas, inner classes, record and switch patterns, per-method time limits and renaming of ambiguous or obfuscated identifiers, optionally through a user-supplied renamer class.","description_zh":"JetBrains 的分析型反编译器，可将 Java class 文件还原为 Java 源码；IntelliJ IDEA 内置了它，用于在调试或浏览 class 文件时显示代码。独立的控制台反编译器接受 class 文件、JAR、ZIP 或目录，可通过 -e 加载仅作为分析上下文的库文件，并将 Java 源码写入输出目录。选项涵盖泛型签名、lambda、内部类、记录模式与 switch 模式、单个方法的处理时限，以及对含糊或混淆标识符的重命名，也可由使用者提供的重命名类来实现。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"hyperdbg","name":"HyperDbg","name_zh":"HyperDbg 虚拟化辅助调试器","url":"https://github.com/HyperDbg/HyperDbg","evidence_url":"https://github.com/HyperDbg/HyperDbg/blob/ff3ba351a1059ce558967aa45a2c70ed25620aa4/README.md","description_en":"Hypervisor-assisted Windows debugger that virtualizes the running system with Intel VT-x and Extended Page Tables to debug kernel and user mode, either locally as a tracing and introspection tool or from a host attached over a serial connection to a guest virtual machine. Its events include EPT-based hidden breakpoints and hooks, memory read, write and execute monitoring without the limits of hardware debug registers, monitoring of system calls, CPUID, MSRs, I/O ports, MMIO, exceptions and interrupts, and Intel PT and LBR branch tracing. A kernel-side script engine, PDB symbol support and an SDK automate analysis.","description_zh":"借助虚拟化技术的 Windows 调试器：利用 Intel VT-x 和扩展页表（EPT）将正在运行的系统虚拟化，从而调试内核态和用户态代码；既可在本机作为跟踪与内省工具运行，也可从宿主机通过串行连接附加到客户虚拟机进行调试。其事件包括基于 EPT 的隐藏断点与钩子、不受硬件调试寄存器限制的内存读写和执行监控，对系统调用、CPUID、MSR、I/O 端口、MMIO、异常和中断的监控，以及 Intel PT 与 LBR 分支跟踪。内核侧脚本引擎、PDB 符号支持和 SDK 可用于自动化分析。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"jpexs-decompiler","name":"JPEXS Free Flash Decompiler (FFDec)","name_zh":"JPEXS Flash 反编译器（FFDec）","url":"https://github.com/jindrapetrik/jpexs-decompiler","evidence_url":"https://github.com/jindrapetrik/jpexs-decompiler/blob/de7efbf4754865f46c1c5bd36c9db9cc4ef2fa0b/README.md","description_en":"Java desktop decompiler and editor for Adobe Flash SWF files. It decompiles ActionScript 1/2 and AS3 side by side with the P-code they came from, edits scripts as source (experimental) or through the assembler view, and exports or replaces images, shapes, sounds, video, fonts and texts, with SWF-to-FLA conversion, SWF-to-XML round trips and SVG or HTML5 Canvas output. It also opens SWC and ABC files, Scaleform GFx and 64-bit Iggy files, has an ActionScript debugger and deobfuscation passes for obfuscated AS3, and offers its parser and decompiler as the ffdec_lib Java library and a command line.","description_zh":"面向 Adobe Flash SWF 文件的 Java 桌面反编译与编辑工具。它可反编译 ActionScript 1/2 和 AS3，并与对应的 P-code 对照显示；既能以源码形式（实验性）编辑脚本，也能通过汇编视图编辑，还可导出或替换图像、形状、声音、视频、字体和文本，支持 SWF 转 FLA、SWF 与 XML 互转，以及输出 SVG 或 HTML5 Canvas。它还能打开 SWC、ABC 文件以及 Scaleform GFx 和 64 位 Iggy 文件，内置 ActionScript 调试器和针对混淆 AS3 的反混淆处理，并以 ffdec_lib Java 库和命令行形式提供其解析与反编译功能。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["game","website"],"verified_at":"2026-10-19"},{"id":"mizuchi-matching-decompilation-pipeline","name":"Mizuchi","name_zh":"Mizuchi 匹配反编译流水线","url":"https://github.com/macabeus/mizuchi","evidence_url":"https://github.com/macabeus/mizuchi/blob/25eaef4214574cc20f376878dbc1b8099e97164e/README.md","description_en":"Plugin pipeline for matching decompilation that loops over functions in an existing decomp project: m2c drafts C, decomp-permuter mutates it, Claude rewrites it through a compile-and-diff tool, and objdiff accepts a result only when the compiled object matches the target assembly. A local Decomp Atlas web app indexes matched and unmatched functions with call graphs and code embeddings, helps pick the next function and builds prompts, while HTML reports summarise each run. An optional integrator places matched C into a git worktree, checks the build and can commit, push or open a PR.","description_zh":"面向匹配反编译的插件式流水线，在现有反编译项目中逐个处理函数：m2c 生成 C 初稿，decomp-permuter 对其做变异，Claude 借助编译并比对的工具改写代码，只有编译出的目标文件与目标汇编一致时才由 objdiff 判定通过。本地 Decomp Atlas 网页应用为已匹配和未匹配函数建立索引，附调用图和代码向量，帮助挑选下一个函数并生成提示词；HTML 报告汇总每次运行结果。可选的集成插件会把匹配成功的 C 代码放入 git 工作树，检查构建，并可提交、推送或发起 PR。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"kuna","name":"Kuna","name_zh":"Kuna 智能体优先反编译器","url":"https://github.com/Noelo-Lab/kuna","evidence_url":"https://github.com/Noelo-Lab/kuna/blob/d1f98e52e054bc7684fd5bb13fca5088f3e09a2d/README.md","description_en":"Agent-first decompiler written in Rust that began as a port of Ghidra’s C++ decompiler and SLEIGH compiler, and has since diverged with option-gated features, some ported from angr. A single self-contained kuna binary decompiles one function or exports a whole binary to C, header and assembly files, and the same engine runs in the browser through WebAssembly or as the decompiler backend inside Ghidra. The project calls itself an experiment in having LLM agents refine the decompiler; most code is agent-written and steered by regression and benchmark results.","description_zh":"以智能体为核心、用 Rust 编写的反编译器，最初移植自 Ghidra 的 C++ 反编译器和 SLEIGH 编译器，此后加入了可按选项开关的功能（部分移植自 angr），已与上游分化。单个自包含的 kuna 程序可反编译单个函数，也可将整个二进制导出为 C、头文件和汇编文件；同一引擎还能通过 WebAssembly 在浏览器中运行，或在 Ghidra 中充当反编译后端。项目自称是让 LLM 智能体持续改进反编译器的实验，大部分代码由智能体编写，并以回归测试和基准结果为导向。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"bytecode-viewer","name":"Bytecode Viewer","name_zh":"Bytecode Viewer Java/Android 逆向工程套件","url":"https://github.com/Konloch/bytecode-viewer","evidence_url":"https://github.com/Konloch/bytecode-viewer/blob/31430e0033fa220db566b5ef461256727ff6793b/README.md","description_en":"Desktop suite for inspecting compiled Java and Android programs: drop in a class, JAR, WAR, APK, DEX, XAPK or APKM file to browse its classes and resources, with up to three decompiler or disassembler views side by side. The README lists six bundled Java decompilers (Krakatau, CFR, Procyon, FernFlower, JADX and JD-GUI), Krakatau and Smali/baksmali disassemblers and assemblers plus javap, Dex2Jar and Enjarify for APK/DEX conversion, a built-in Java compiler for editing, and static search. Java and JavaScript plugins receive every loaded class as an ASM ClassNode for jobs such as string deobfuscation or malicious-code searches.","description_zh":"用于检查已编译 Java 与 Android 程序的桌面套件：拖入 class、JAR、WAR、APK、DEX、XAPK 或 APKM 文件即可浏览其中的类和资源，并可并排显示最多三个反编译器或反汇编器视图。README 列出六个内置 Java 反编译器（Krakatau、CFR、Procyon、FernFlower、JADX 和 JD-GUI）、Krakatau 与 Smali/baksmali 反汇编器和汇编器以及 javap，还有用于 APK/DEX 转换的 Dex2Jar 和 Enjarify、用于编辑的内置 Java 编译器和静态搜索。Java 和 JavaScript 插件会收到全部已加载类的 ASM ClassNode，可用于字符串去混淆或恶意代码搜索等任务。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"binary-ninja-api","name":"Binary Ninja API","name_zh":"Binary Ninja 公开 API","url":"https://github.com/Vector35/binaryninja-api","evidence_url":"https://github.com/Vector35/binaryninja-api/blob/14d46ea2a46330b0b6abbea8dcb620f84494fc8b/README.md","description_en":"Vector 35’s public C++, Python and Rust APIs for Binary Ninja, with their documentation, examples and the open-source plugins built on them. Binary Ninja itself is a closed-source commercial application, and this repository does not contain its analysis core. The open plugins cover the x86/x86_64, ARM64, ARMv7, PowerPC, MIPS, RISC-V and MSP430 architectures, ELF, PE/COFF, Mach-O and Apple shared-cache and kernel-cache loaders, DWARF, PDB and IDB import, and Objective-C, RTTI and SVD analysis, while the examples walk the low- and medium-level intermediate languages and extend the analysis pipeline through workflows.","description_zh":"Vector 35 为 Binary Ninja 公开的 C++、Python 和 Rust API，附带文档、示例以及基于这些 API 的开源插件。Binary Ninja 本身是闭源商业软件，本仓库不包含其分析核心。开源插件涵盖 x86/x86_64、ARM64、ARMv7、PowerPC、MIPS、RISC-V 和 MSP430 架构，ELF、PE/COFF、Mach-O 以及 Apple 共享缓存和内核缓存加载器，DWARF、PDB 与 IDB 导入，以及 Objective-C、RTTI 和 SVD 分析；示例则演示如何遍历低级与中级中间语言，并通过工作流扩展分析流程。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"openrw-gta3-engine-case","name":"OpenRW: an open re-implementation of the Grand Theft Auto III engine","name_zh":"OpenRW：《侠盗猎车手 III》引擎的开源重新实现","url":"https://github.com/rwengine/openrw","evidence_url":"https://github.com/rwengine/openrw/blob/5c5f266b71aa55aeec8cb4d823f19e7c4348f3bd/README.md","description_en":"Re-implements Rockstar Games’ Grand Theft Auto III (2001) as a cross-platform C++ engine that runs on the data of a legitimate PC copy. It has its own loaders for the game’s RenderWare models, textures and archives, a script machine for the original mission scripts, and an optional Qt data viewer. Playability is partial: the project’s mission tracker marks six early Portland story missions as completable.","description_zh":"以跨平台 C++ 引擎重新实现 Rockstar Games 的《侠盗猎车手 III》（2001），在正版 PC 游戏的数据上运行。项目自行实现了游戏 RenderWare 模型、纹理和归档的加载器，提供执行原版任务脚本的脚本机，并附带可选的 Qt 数据查看器。可玩程度有限：项目的任务追踪清单只将波特兰的六个早期剧情任务标为可完成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"rexglue-sdk","name":"ReXGlue SDK","name_zh":"ReXGlue Xbox 360 静态重编译 SDK","url":"https://github.com/rexglue/rexglue-sdk","evidence_url":"https://github.com/rexglue/rexglue-sdk/blob/c94f5ebdcb3c9d1a460ca48e04f9758448f8d518/README.md","description_en":"Experimental SDK for statically recompiling Xbox 360 executables into portable C++23 that runs natively on Windows, Linux and macOS. Its rexglue CLI scaffolds a per-game CMake project and, from a TOML config, analyzes a XEX binary (import resolution, PDATA, block discovery, gap filling, jump resolution and call-target validation) before translating each PowerPC instruction into C++; a runtime derived from Xenia's emulator core, with D3D12 or Vulkan graphics, hosts the generated code. Generated functions are weak aliases that native C++ overrides or mid-function hooks can replace, so a port can be refined one function at a time.","description_zh":"实验性 SDK，可将 Xbox 360 可执行文件静态重编译为可移植的 C++23 代码，在 Windows、Linux 和 macOS 上原生运行。其 rexglue 命令行工具为单个游戏搭建 CMake 项目，并根据 TOML 配置分析 XEX 二进制（导入解析、PDATA、基本块发现、空隙填充、跳转解析和调用目标校验），再将每条 PowerPC 指令翻译为 C++；生成的代码由派生自 Xenia 模拟器核心的运行时承载，图形后端为 D3D12 或 Vulkan。生成的函数均为弱别名，可用原生 C++ 覆盖或在函数内插入钩子来替换，从而逐个函数完善移植。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"reagent-cpp-reconstruction-agent","name":"ReAgent","name_zh":"ReAgent C/C++ 函数重建智能体","url":"https://github.com/Dryxio/reagent","evidence_url":"https://github.com/Dryxio/reagent/blob/d12cea338c61898b06a86fe8adb25275fa9d5615/README.md","description_en":"An open-source Python agent, published on PyPI as auto-re-agent, that drafts C/C++ implementations of functions in a compiled program from Ghidra evidence and has a separately configurable checker model review each draft in a bounded fix loop. A candidate is accepted only after a structural comparison with the decompile, assembly, control-flow and P-code evidence, the project’s own build, test and optional differential commands, and 11 heuristic parity signals. The README calls these gates conservative evidence, not proof of equivalence, and the tool writes candidates to an overlay rather than patching the source tree.","description_zh":"开源 Python 智能体，以 auto-re-agent 之名发布于 PyPI。它依据 Ghidra 提供的证据为已编译程序中的函数起草 C/C++ 实现，再由可单独配置的检查模型在有轮数上限的修复循环中审阅每份草稿。候选代码须先与反编译、汇编、控制流和 P-code 证据做结构比对，再通过项目自己的构建、测试及可选的差分命令和 11 项启发式一致性信号，才会被接受。README 称这些关卡只是保守的证据，并非等价性证明；工具把候选代码写入覆盖层，而不直接修改源码树。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"capa","name":"capa","name_zh":"capa 可执行文件功能识别工具","url":"https://github.com/mandiant/capa","evidence_url":"https://github.com/mandiant/capa/blob/7a235c46965ea0965c65be3b9ee1e21dca686f3d/README.md","description_en":"Mandiant FLARE tool that reports what an executable can do by matching a YAML rule set against features extracted from PE, ELF and .NET files or 32/64-bit shellcode, such as API calls, imports, strings and constants. Matches are grouped into capability namespaces with ATT&CK and MBC tags, and verbose output shows the function or basic-block addresses and features behind each match, pointing analysts to code worth studying. It also reads CAPE, DRAKVUF and VMRay sandbox reports for dynamic features and can use vivisect, IDA Pro, Ghidra or Binary Ninja for analysis, with explorer plugins for IDA and Ghidra and a browser viewer for its JSON results.","description_zh":"Mandiant FLARE 团队的工具，将 YAML 规则集与从 PE、ELF、.NET 文件或 32/64 位 shellcode 中提取的 API 调用、导入、字符串和常量等特征进行匹配，报告可执行文件具备哪些功能。匹配结果按功能命名空间归类并标注 ATT&CK 和 MBC，详细输出会列出每项匹配所依据的函数或基本块地址及特征，为分析人员指出值得深入研究的代码。它还能读取 CAPE、DRAKVUF 和 VMRay 沙箱报告以利用动态特征，可选用 vivisect、IDA Pro、Ghidra 或 Binary Ninja 进行分析，并提供 IDA 和 Ghidra 的 explorer 插件以及查看 JSON 结果的浏览器界面。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"ruffle-flash-player-case","name":"Ruffle: a Rust reimplementation of Adobe Flash Player","name_zh":"Ruffle：用 Rust 重新实现的 Adobe Flash Player","url":"https://github.com/ruffle-rs/ruffle","evidence_url":"https://github.com/ruffle-rs/ruffle/blob/ea24ef78aa6c898e8170c1a603a496dd1131bd6c/README.md","description_en":"Reimplements Adobe Flash Player in Rust so that SWF content, from ActionScript 1/2 (AVM1) to ActionScript 3 (AVM2), runs in a native desktop player or in browsers through WebAssembly, as a self-hosted script or a browser extension. Its contributor guide says behavior comes from observing Flash Player's output or from license-compatible sources such as Adobe's open avmplus code, and forbids decompiling Flash Player, Flash Professional or Animate. Regression tests run contributor-made SWFs and compare their trace output, and optionally rendered images, with captures from the official debug Flash Player.","description_zh":"用 Rust 重新实现 Adobe Flash Player，使从 ActionScript 1/2（AVM1）到 ActionScript 3（AVM2）的 SWF 内容能在原生桌面播放器中运行，或通过 WebAssembly 以自托管脚本或浏览器扩展的形式在浏览器中运行。其贡献指南称，行为依据对 Flash Player 输出的观察或 Adobe 开源的 avmplus 等许可兼容来源确定，并禁止反编译 Flash Player、Flash Professional 或 Animate。回归测试运行贡献者自制的 SWF，将其 trace 输出（以及可选的渲染图像）与官方调试版 Flash Player 的记录进行比较。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game","website"],"verified_at":"2026-10-19"},{"id":"ps3recomp","name":"ps3recomp","name_zh":"ps3recomp PS3 静态重编译工具包","url":"https://github.com/sp00nznet/ps3recomp","evidence_url":"https://github.com/sp00nznet/ps3recomp/blob/39a36296511c445707adabcd312f0b740cfbd694/README.md","description_en":"Toolkit and runtime for statically recompiling PlayStation 3 games into native executables. Python tools parse PS3 ELF and PRX files, find functions and firmware imports, and lift PPU and SPU code to C/C++; a project template links that code with a C/C++ runtime providing LV2 system calls, high-level emulation of the system libraries and RSX graphics translation to Direct3D 12, Metal or Vulkan.","description_zh":"用于将 PlayStation 3 游戏静态重编译为原生可执行文件的工具包与运行时。Python 工具解析 PS3 ELF 和 PRX 文件，识别函数与固件导入，并将 PPU 和 SPU 代码提升为 C/C++；项目模板再将这些代码与 C/C++ 运行时链接，由运行时提供 LV2 系统调用、系统库的高层仿真，以及转换到 Direct3D 12、Metal 或 Vulkan 的 RSX 图形层。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"nebulafd","name":"Nebula (NebulaFD)","name_zh":"Nebula（NebulaFD）Clickteam Fusion 反编译器","url":"https://github.com/AITYunivers/NebulaFD","evidence_url":"https://github.com/AITYunivers/NebulaFD/blob/a24d4d1da78c35412413faac750e07ff7d603a8a/Nebula.CLI/Program.cs","description_en":"Work-in-progress decompiler for games made with Clickteam Fusion 2.5, with fixes for older Multimedia Fusion 1.5 files. Its .NET console app reads Windows executables, Android APKs, iOS IPAs, CCN data files and existing MFA projects, then runs plug-in tools: an MFA Parser that writes the game back out as an editable Fusion project, and an Asset Dumper for images, sounds, music, fonts, icons, shaders and packed files.","description_zh":"面向 Clickteam Fusion 2.5 游戏的反编译器，仍在开发中，也针对更早的 Multimedia Fusion 1.5 文件做了修复。其 .NET 控制台程序可读取 Windows 可执行文件、Android APK、iOS IPA、CCN 数据文件以及现有的 MFA 项目，再运行插件式工具：MFA Parser 将游戏重新写成可编辑的 Fusion 项目，Asset Dumper 则导出图像、音效、音乐、字体、图标、着色器和打包文件。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-19"},{"id":"scooterlink-honda-roadsync-case","name":"ScooterLink: reconstructing Honda RoadSync’s handlebar-button protocol","name_zh":"ScooterLink：重建 Honda RoadSync 车把按键协议","url":"https://github.com/gdorgian/ScooterLink","evidence_url":"https://github.com/gdorgian/ScooterLink/blob/a089f6210e863d56b590ed4625b92f886ff6a097/docs/PROTOCOL.md","description_en":"Replaces Honda RoadSync’s Apple Music-only media control with an iOS app that pairs with a Honda PCX 2025 TFT dash over Bluetooth Low Energy and turns handlebar presses into system-wide commands for any player. The author documents the dash’s BLE services, key exchange, button registration and event bytes, reportedly worked out from the official Android app and logged traffic. Results are author-reported on one PCX125, and the protocol notes separate confirmed from unverified parts.","description_zh":"以一个 iOS 应用替代 Honda RoadSync 仅支持 Apple Music 的媒体控制：通过低功耗蓝牙与 Honda PCX 2025 的 TFT 仪表配对，把车把按键转换为对任意播放器生效的系统级命令。作者记录了仪表的 BLE 服务、密钥交换、按键注册与事件字节，据称依据官方 Android 应用及通信日志推断得出。结果为作者在一台 PCX125 上的报告，协议说明区分了已确认与未验证的部分。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"frontkick-rikugan-crebench-comparison","name":"Frontkick vs Rikugan: a CREBench agent comparison","name_zh":"Frontkick 与 Rikugan：基于 CREBench 的智能体对比","url":"https://www.synacktiv.com/en/publications/ufc-666-frontkick-vs-rikugan","evidence_url":"https://www.synacktiv.com/en/publications/ufc-666-frontkick-vs-rikugan","description_en":"Matthieu Breuil’s Synacktiv article explains tool-calling and code-executing agent designs and describes Frontkick, a CodeAct agent that runs generated Python inside Binary Ninja. It compares Frontkick with the open-source Rikugan plugin on two CREBench cryptographic binary tasks, then attributes most of Frontkick’s advantage to a prompt that listed installed Python libraries rather than to its architecture. It is a small evaluation write-up with per-run results, not a released tool or a general benchmark finding.","description_zh":"Matthieu Breuil 在 Synacktiv 发表的文章讲解了调用预定义工具与执行生成代码两类智能体设计，并介绍在 Binary Ninja 内运行生成的 Python 代码的 CodeAct 智能体 Frontkick。文章在 CREBench 的两个密码二进制任务上将 Frontkick 与开源插件 Rikugan 对比，随后指出 Frontkick 的优势主要来自提示词中列出已安装 Python 库的做法，而非其架构本身。这是一篇附逐次运行结果的小规模评估文章，不是已发布的工具，也不是普遍性的基准结论。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"opendmcufirm-wii-u-dmcu-firmware-case","name":"OpenDMCUFirm: a reimplemented Wii U DMCU display firmware","name_zh":"OpenDMCUFirm：重新实现的 Wii U DMCU 显示固件","url":"https://github.com/GaryOderNichts/OpenDMCUFirm","evidence_url":"https://github.com/GaryOderNichts/OpenDMCUFirm/blob/9e6747f71cb91f2c182869b4df1091f6d5d8218d/README.md","description_en":"Reimplements in C the firmware of the Wii U’s DMCU, the M68HC11-compatible display microcontroller in its AMD graphics controller, which in Wii mode reads the Video Interface state and configures display output, deinterlacing, scaling and overscan. The README says the work is based on reverse engineering of the original firmware but is not a byte-for-byte matching decompilation, and calls it a work in progress. The built image replaces the stock firmware in Wii mode when loaded through the evWii plugin.","description_zh":"用 C 语言重新实现 Wii U 的 DMCU 固件。DMCU 是其 AMD 图形控制器中兼容 M68HC11 的显示微控制器，在 Wii 模式下读取视频接口（VI）状态，并配置显示输出、去隔行、缩放与过扫描。README 称这项工作基于对原固件的逆向工程，但并非逐字节一致的反编译，并说明项目仍在开发中。构建出的镜像经 evWii 插件载入后，在 Wii 模式下替代原厂固件。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"cod4-rewrite-reconstruction-case","name":"CoD4 Rewrite: Rust/Bevy reconstruction","name_zh":"CoD4 Rewrite：Rust/Bevy 游戏重建","url":"https://github.com/Nilbong/COD4-Rewrite","evidence_url":"https://github.com/Nilbong/COD4-Rewrite/blob/bd03eb07f2b2ec84dd33946bfc2b8163fc49c480/README.md","description_en":"A Rust/Bevy reconstruction of Call of Duty 4 multiplayer systems, using assets from a local game installation. Source covers menus, local bots, movement and combat, and connects custom relay-based netplay to the game.","description_zh":"以 Rust/Bevy 重建《使命召唤4》的多人游戏系统，使用本地游戏安装中的素材。源码包含菜单、本地机器人、移动和战斗，并将自定义中继联机实现接入游戏。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"libd2-engine-core-reconstruction-case","name":"libd2: Diablo II 1.14d engine-core libraries","name_zh":"libd2：《暗黑破坏神II》1.14d 引擎组件库","url":"https://github.com/jaenster/libd2","evidence_url":"https://github.com/jaenster/libd2/blob/bc21bb924b9238def4907bd2b3f79e8041a5fc0a/README.md","description_en":"Zig libraries reconstructing Diablo II 1.14d seeded maps, item generation, saves, simulation rules and network formats. Selected components expose native and WebAssembly interfaces; verification notes distinguish retail map comparisons from weaker subsystem evidence.","description_zh":"以 Zig 库重建《暗黑破坏神II》1.14d 的种子地图、物品生成、存档、模拟规则和网络格式。部分组件提供原生与 WebAssembly 接口；验证说明区分了原游戏地图对照与其他子系统较弱的证据。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game","protocol"],"verified_at":"2026-10-19"},{"id":"underworld-exhumed-case","name":"Underworld Exhumed: reconstructing Ultima Underworld I and II","name_zh":"Underworld Exhumed：重建 Ultima Underworld I 与 II","url":"https://github.com/abedegno/underworld-exhumed","evidence_url":"https://github.com/abedegno/underworld-exhumed/blob/e5deadd6945b492636aadccc14f52caa908b4186/README.md","description_en":"Pairs reconstructed DOS sources with native ports of Ultima Underworld I and II. The upstream documents Exhume-based byte-matching builds, routine-level comparisons and recorded-session replay against DOS.","description_zh":"将 Ultima Underworld I 与 II 的 DOS 源码重建与原生移植结合。上游记录了基于 Exhume 的字节匹配构建、例程级比较及对照 DOS 的录制会话回放。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game"],"verified_at":"2026-10-20"},{"id":"linewars-ii-sdl-case","name":"LineWars II: a portable SDL3 reconstruction","name_zh":"LineWars II：可移植的 SDL3 重建版","url":"https://github.com/fredangstadt-lang/LineWarsII-SDL","evidence_url":"https://github.com/fredangstadt-lang/LineWarsII-SDL/blob/343bb50942a61e9d7fa1c1314cd1f03f8e7b12ac/README.md","description_en":"Provides an SDL3 backend for a portable-C reconstruction of the 1994 DOS game. Its build configuration links the reconstructed engine to video, input and audio adapters; the upstream documents differential gates against original machine code.","description_zh":"为 1994 年 DOS 游戏的可移植 C 重建提供 SDL3 后端。构建配置将重建引擎接到视频、输入与音频适配层，上游记录了对照原始机器码的差分测试关卡。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game"],"verified_at":"2026-10-20"},{"id":"bfm-decomp-case","name":"BFM-decomp: Brave Fencer Musashi matching decompilation","name_zh":"BFM-decomp：Brave Fencer Musashi 匹配反编译","url":"https://github.com/Druthulu/BFM-decomp","evidence_url":"https://github.com/Druthulu/BFM-decomp/blob/b6a28f96bac70af70573826f767a96cf212fd5e3/README.md","description_en":"Documents an agent-assisted reconstruction of the USA PlayStation game with a pinned compiler and whole-binary SHA-1 gates. The verification recipe covers the main executable, resident engine and disc-loaded code modules, with explicit library and assembly exceptions.","description_zh":"记录美版 PlayStation 游戏的智能体辅助重建，使用固定编译器及完整二进制 SHA-1 检查。验证规约覆盖主程序、常驻引擎及光盘加载代码模块，并明确列出库与汇编例外。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game"],"verified_at":"2026-10-20"},{"id":"logic-lens","name":"Logic-Lens","name_zh":"Logic-Lens：实验性 JavaScript 源码理解工具","url":"https://github.com/Abdoulrazack1/Logic-Lens","evidence_url":"https://github.com/Abdoulrazack1/Logic-Lens/blob/bb15aab345de64ef044a074d5e564fb087999032/README.md","description_en":"Experimental JavaScript source-analysis toolkit that classifies AST-token sequences into configured formula families after local training, and produces heuristic structure, call-graph and intent reports. It supports code-comprehension experiments; its predictions do not establish arbitrary program invariants or semantic equivalence.","description_zh":"实验性 JavaScript 源码分析工具：本地训练后将 AST token 序列归入预设公式类别，并生成启发式结构、调用图和意图报告。它可用于代码理解实验，但预测结果不证明任意程序的不变量或语义等价。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"android-security-toolkit","name":"Android Security Toolkit","name_zh":"Android Security Toolkit：APK 静态初步分析","url":"https://github.com/abhirampatel/android-security-toolkit","evidence_url":"https://github.com/abhirampatel/android-security-toolkit/blob/d9153acad34a062298b15244a0c38f0497680dbf/README.md","description_en":"Local Python APK triage tool that drives apktool and strings, checks manifest settings and source/native-library strings, and produces TXT/JSON findings for manual review. Its rules flag possible issues without proving exploitability or reconstructing application behavior.","description_zh":"本地 Python APK 初步分析工具，调用 apktool 与 strings 检查清单配置、源码及原生库字符串，输出 TXT／JSON 结果供人工核验。规则仅提示潜在问题，不证明可利用性，也不重建应用行为。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"littlebird-static-rebuild-case","name":"Littlebird.ai static home-page rebuild","name_zh":"Littlebird.ai 静态首页重建","url":"https://github.com/AkashNaickar/crdb-sample-frontend","evidence_url":"https://github.com/AkashNaickar/crdb-sample-frontend/blob/673dc8c8d93b4f8a13257604749b638adf146298/README.md","description_en":"Rebuilds the Littlebird.ai home page in plain HTML/CSS/JavaScript from captured markup and assets, with source-wired mobile navigation, FAQ toggles, scroll reveals and OS-dependent call-to-action presentation. It illustrates a bounded website reconstruction, with uncaptured routes and product functionality left outside the scope.","description_zh":"依据捕获的标记与资源，用原生 HTML/CSS/JavaScript 重建 Littlebird.ai 首页；源码实现移动导航、FAQ 展开、滚动显现及随操作系统变化的按钮展示。它是范围明确的网页重建案例，不涵盖未捕获路由或产品本身的功能。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["website"],"verified_at":"2026-10-20"},{"id":"akiselev-ilspy-cli","name":"ilspy-cli: targeted .NET decompilation for agents","name_zh":"ilspy-cli：面向 Agent 的定向 .NET 反编译","url":"https://github.com/akiselev/ilspy-cli","evidence_url":"https://github.com/akiselev/ilspy-cli/blob/089895f16a9031bb8391db13c2160def9a2e8b60/README.md","description_en":"Rust CLI that hosts an ILSpy C# bridge in-process for assembly, type and named-method decompilation, source search and structured JSON output. A separate PE-header detector identifies managed assemblies without loading the .NET runtime.","description_zh":"通过进程内托管的 ILSpy C# 桥接层，提供程序集、类型和指定方法的反编译、源码搜索及结构化 JSON 输出的 Rust CLI；独立的 PE 头检测器无需加载 .NET 运行时即可识别托管程序集。","kind":"tool","category":"dotnet","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"swe1r-assets-unity","name":"swe1r-assets-unity: Racer model-block editor sample","name_zh":"swe1r-assets-unity：Racer 模型块编辑器样例","url":"https://github.com/akopetsch/swe1r-assets-unity","evidence_url":"https://github.com/akopetsch/swe1r-assets-unity/blob/2fcae9138583da959882171095920ab9b802168b/README.md","description_en":"Work-in-progress Unity editor sample for importing and modifying Star Wars Episode I: Racer model blocks, then serializing them back through swe1r-assets. Its editor includes an unmodified import/export byte-comparison command; it is an asset-format workflow rather than a reimplementation of the game.","description_zh":"尚在开发中的 Unity 编辑器样例，可导入和修改《星球大战：极速飞车》的模型块，再通过 swe1r-assets 序列化回原格式。编辑器提供未修改导入／导出结果的字节比较命令；其范围是资产格式工作流，而非完整游戏重实现。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-20"},{"id":"react-decode","name":"React-Decode","name_zh":"React-Decode","url":"https://github.com/alexandra-seredkina/React-Decode","evidence_url":"https://github.com/alexandra-seredkina/React-Decode/blob/80e8bda2912b7e3f9e01bc3a0034a61ea488b14a/README.md","description_en":"Static-analysis CLI for compiled React JavaScript that produces readable bundle output and inferred API-request, route and application-constant reports. It can extract embedded source-map contents when available.","description_zh":"面向已构建 React JavaScript 的静态分析 CLI，可输出更易读的代码，以及推断的 API 请求、路由和应用常量报告；存在 source map 内嵌源码时可将其提取。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-20"},{"id":"wasmlens","name":"WasmLens: exploratory WebAssembly inspection","name_zh":"WasmLens：探索性 WebAssembly 检查","url":"https://github.com/alexandrmotologa/wasmlens","evidence_url":"https://github.com/alexandrmotologa/wasmlens/blob/2351cccea90f812053b30d1ad14816d3c664a4f7/README.md","description_en":"Python CLI with static paths for inspecting WebAssembly sections and function signatures, producing WAT-style instruction listings, and reconstructing limited C-like pseudocode. These are exploratory analysis aids for supported modules, not recovered original source or a complete WebAssembly runtime.","description_zh":"提供 WebAssembly 区段与函数签名检查、WAT 风格指令列表和有限 C 风格伪代码重建的 Python CLI。所收录的是面向受支持模块的探索性静态分析路径，不代表恢复原始源码或实现完整 WebAssembly 运行时。","kind":"tool","category":"webassembly","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"submitgame-awesome-decomp-games","name":"Awesome Decomp Games","name_zh":"Awesome Decomp Games：附评分、每日刷新的游戏重建项目目录","url":"https://github.com/SubmitGame/awesome-decomp-games","evidence_url":"https://github.com/SubmitGame/awesome-decomp-games/blob/02727e90fe10c7b55fad3fdd4bd671c55e1fe587/README.md","description_en":"A generated, rated index of public game reconstruction projects: decompilations, disassemblies, static recompilations, source ports, engine remakes and browser ports. A daily job merges several upstream lists and registries with GitHub and decomp.dev metadata, drops dead links and rebuilds the README and website from data files. Useful for discovery; its scores are automated heuristics, not reviews.","description_zh":"自动生成并附评分的公开游戏重建项目索引，涵盖反编译、反汇编、静态重编译、源码移植、引擎重制及浏览器移植。每日任务合并多个上游目录与登记站点，结合 GitHub 和 decomp.dev 元数据，剔除失效链接，再由数据文件重建 README 和网站。适合用来发现项目；其评分是自动启发式结果，并非人工审阅。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["game"],"verified_at":"2026-10-18"},{"id":"snowboardkids-matching-decomp-case","name":"Snowboard Kids: an agent-assisted N64 matching decompilation","name_zh":"Snowboard Kids：智能体辅助的 N64 匹配反编译","url":"https://github.com/cdlewis/snowboardkids-decomp","evidence_url":"https://github.com/cdlewis/snowboardkids-decomp/blob/0a398d907aae32ae45e6ba0ca688049e5c60dab8/README.md","description_en":"A matching decompilation of the original Nintendo 64 Snowboard Kids that rebuilds SHA1-identical North American and Japanese ROMs from a user-supplied ROM. The author’s 84-day post-mortem describes coding agents run through his Nigel harness alongside m2c, the permuter and a shared file of compiler learnings, and declines to credit LLMs alone for the speed-up. It is a separate project from the Snowboard Kids 2 decompilation.","description_zh":"原版 Nintendo 64 游戏 Snowboard Kids 的匹配反编译，利用使用者自备的 ROM 重新构建 SHA1 一致的北美版与日版 ROM。作者在 84 天复盘文章中介绍了通过自建的 Nigel 工具调度编程智能体，并结合 m2c、permuter 与共享编译器经验文件的流程，同时表示不应把提速完全归功于大模型。它与 Snowboard Kids 2 反编译是不同的项目。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"reflecticon-224-lexicon-emulation-case","name":"reflecticon-224: running Lexicon 224 reverb firmware on emulated hardware","name_zh":"reflecticon-224：在模拟硬件上运行 Lexicon 224 混响器固件","url":"https://github.com/joelanders/reflecticon-224","evidence_url":"https://github.com/joelanders/reflecticon-224/blob/37fde47f6cf94d4f4f96f3c233382e2c43a70354/Makefile","description_en":"Emulates the Lexicon 224, 224X and 224XL digital reverbs so that their own firmware runs in a browser page or a JUCE plugin. The repository layers KiCad schematics, gate-level and board-level Verilog models, an 8080-hosted C++ emulator and analog input/output models, and checks faster layers against slower ones using user-supplied ROMs. It is a work-in-progress hardware-and-firmware emulation whose documentation is still pending, not recovered algorithm source.","description_zh":"模拟 Lexicon 224、224X 与 224XL 数字混响器，使其原厂固件能在浏览器页面或 JUCE 插件中运行。仓库分层包含 KiCad 原理图、门级与板级 Verilog 模型、以 8080 为主机的 C++ 模拟器及模拟输入／输出模型，并用使用者自备的 ROM 以较慢层级校验较快层级。这是仍在开发、文档尚未完成的硬件与固件模拟，并非恢复出的算法源码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-10-18"},{"id":"sa3-marun-ai-decomp-case","name":"Sonic Advance 3: an AI-assisted match of one enemy module","name_zh":"Sonic Advance 3：AI 辅助匹配单个敌人模块","url":"https://gambiconf.substack.com/p/development-journey-on-game-decompilation","evidence_url":"https://gambiconf.substack.com/p/development-journey-on-game-decompilation","description_en":"Macabeus’s dated study describes prompting Claude Sonnet 3.5 and DeepSeek R1 with assembly, similar decompiled functions and structs to write matching C for Marun, one enemy module of the community Sonic Advance 3 GBA decompilation. The resulting pull request replaced that module’s assembly and was merged; the author calls the setting unusually AI-friendly, and the project now bars LLM-origin contributions.","description_zh":"Macabeus 在注明日期的研究文章中，介绍了如何把汇编、相似的已反编译函数和结构体放进提示词，让 Claude Sonnet 3.5 与 DeepSeek R1 为社区 Sonic Advance 3 GBA 反编译项目中的敌人模块 Marun 编写匹配的 C 代码。由此产生的拉取请求替换了该模块的汇编并已合并；作者认为这一场景对 AI 格外友好，而该项目现已不接受源自大模型的贡献。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ix500-scan-scansnap-wifi-case","name":"iX500 Scan: a macOS client for the reverse-engineered ScanSnap Wi-Fi protocol","name_zh":"iX500 Scan：基于逆向 ScanSnap Wi-Fi 协议的 macOS 客户端","url":"https://github.com/jonaswagnr/ix500-scan","evidence_url":"https://github.com/jonaswagnr/ix500-scan/blob/24a5f7c89fc6d0c35a4d83d0879348ced153844a/README.md","description_en":"Replaces ScanSnap Home for a Fujitsu/PFU ScanSnap iX500 on macOS with a SwiftUI app and Python service that scan over Wi-Fi through the community-reverse-engineered VENS protocol, or over USB through SANE, and produce searchable PDFs. It vendors bramheerink’s GPL-2.0 driver, extends it for macOS, and documents further handshake and hardware-status fields, including the scan-button bit. Results are author-reported; the repository publishes no tests or captures.","description_zh":"在 macOS 上以 SwiftUI 应用和 Python 后台服务替代 ScanSnap Home，为富士通／PFU ScanSnap iX500 提供扫描：Wi-Fi 经由社区逆向的 VENS 协议，USB 经由 SANE，输出可搜索的 PDF。项目内置 bramheerink 的 GPL-2.0 驱动并为 macOS 做了扩展，还记录了更多握手字段和硬件状态字段，包括扫描键状态位。结果均为作者报告，仓库未公开测试或抓包记录。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"roborock-local-server-cloud-case","name":"Roborock Local Server: a self-hosted stand-in for Roborock’s vacuum cloud","name_zh":"Roborock Local Server：自托管替代 Roborock 扫地机云端","url":"https://github.com/Python-roborock/local_roborock_server","evidence_url":"https://github.com/Python-roborock/local_roborock_server/blob/c3b32845c63a4bc9d1fc9dfb205b86a33ea06bf3/docs/technical_writeup.md","description_en":"Runs a local HTTPS and MQTT stack in place of Roborock’s cloud, so supported vacuums keep live maps and controls on an isolated network without rooting or hardware changes. The maintainer’s technical write-up recounts earlier app and traffic analysis and a later investigation in which Claude Code and Codex worked against an emulated firmware environment. Compatibility is reported per model by the project and its users.","description_zh":"运行一套本地 HTTPS 与 MQTT 服务来替代 Roborock 云端，使受支持的扫地机在隔离网络中无需 root 或改装硬件即可保留实时地图与控制。维护者的技术说明回顾了早期的应用与流量分析，以及后来借助 Claude Code 和 Codex、在模拟固件环境中开展的调查。兼容性由项目及其用户按型号报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"wristbeam-garmin-watch-protocol-case","name":"WristBeam: reconstructing Garmin’s watch protocol for a Mac companion","name_zh":"WristBeam：为 Mac 配套应用重建佳明手表协议","url":"https://github.com/kongdayan/wristbeam","evidence_url":"https://github.com/kongdayan/wristbeam/blob/712f577ac55b476ff91e0b44565934ac0d4cad4d/README.md","description_en":"Implements a Garmin watch companion as a native macOS menu-bar app that pairs over Bluetooth, receives live health notifications and original FIT files, and can upload them to Garmin Connect. Source comments attribute its GFDI framing, handshake, file-transfer and status fields to analysis of a supplied Garmin Android package, cross-checked against community implementations such as Gadgetbridge. Device verification covers one watch model, and the opt-in MCP and HTTP interfaces expose only locally cached data.","description_zh":"以原生 macOS 菜单栏应用实现佳明手表的配套客户端：通过蓝牙配对，接收实时健康通知和原始 FIT 文件，并可上传至 Garmin Connect。源码注释称，GFDI 分帧、握手、文件传输和状态字段依据对一个自备佳明 Android 安装包的分析实现，并与 Gadgetbridge 等社区实现相互核对。设备验证仅涵盖一款手表；可选启用的 MCP 与 HTTP 接口只提供本地缓存的数据。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"abc-decompiler","name":"abc-decompiler","name_zh":"abc-decompiler 鸿蒙方舟字节码反编译器","url":"https://github.com/ohos-decompiler/abc-decompiler","evidence_url":"https://github.com/ohos-decompiler/abc-decompiler/blob/427c4cd9f80496236a4a3548d29a6b8aaf74b8e0/README.md","description_en":"Decompiler for HarmonyOS Ark bytecode (.abc), the format HarmonyOS app packages carry in modules.abc, built by adapting the jadx decompiler and reading files through a patched copy of the abcde library. Because much of Ark bytecode is semantically close to DEX, it reuses jadx's GUI, IR and passes: an .abc file dropped into the jadx-based window is shown as decompiled code. The README reports that all 227 usable instructions of the 282 Ark opcodes are implemented, most special instructions as pseudo-functions.","description_zh":"面向鸿蒙方舟字节码（.abc）的反编译工具；HarmonyOS 应用包中的 modules.abc 即为此格式。它通过改造 jadx 反编译器实现，并借助打过补丁的 abcde 库读取文件。由于方舟字节码有很大一部分与 DEX 字节码语义相近，它沿用了 jadx 的图形界面、中间表示和处理流程：把 .abc 文件拖入基于 jadx 的窗口即可查看反编译代码。README 称 282 条方舟字节码中可用的 227 条指令均已实现，其中大部分特殊指令以伪函数形式实现。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"pypush-apns-protocol-case","name":"pypush: a Python client for Apple’s push protocol","name_zh":"pypush：Apple 推送协议的 Python 客户端","url":"https://github.com/JJTech0130/pypush","evidence_url":"https://github.com/JJTech0130/pypush/blob/71aa2e4442061596f75e6b02dfad613330127b5b/README.md","description_en":"Reimplements the client side of Apple’s private Apple Push Notification service (APNs) protocol in platform-independent Python: it activates as an Apple device, connects to the APNs courier, mints app-scoped tokens and receives push notifications. The project began as the author’s proof of concept for iMessage reverse engineering, but the current rewrite has removed IDS and iMessage support for now. It uses Apple’s services outside Apple’s official clients.","description_zh":"以与平台无关的 Python 重新实现 Apple 私有推送通知服务（APNs）协议的客户端：它以 Apple 设备身份完成激活，连接 APNs courier 服务器，生成限定于应用的令牌并接收推送通知。项目最初是作者 iMessage 逆向研究的概念验证，但当前重写版暂时移除了 IDS 和 iMessage 支持。它在 Apple 官方客户端之外使用 Apple 的服务。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"luajit-decompiler-v2","name":"LuaJIT Decompiler v2","name_zh":"LuaJIT Decompiler v2 字节码反编译器","url":"https://github.com/marsinator358/luajit-decompiler-v2","evidence_url":"https://github.com/marsinator358/luajit-decompiler-v2/blob/6a8a0cec48fdf175dddaca5d3fbfe3aa59b5550a/README.md","description_en":"Decompiles LuaJIT bytecode files back into Lua source, written as a replacement for the older Python LuaJIT decompiler. The README reports full support for gotos and for stripped bytecode, including reconstructed locals and upvalues, and its boolean-expression recovery follows a published decompilation algorithm. It processes single files or whole folders and writes .lua output.","description_zh":"将 LuaJIT 字节码文件反编译回 Lua 源码，作为旧版 Python LuaJIT 反编译器的替代品编写。README 称它完整支持 goto 和去除调试信息的字节码，包括还原局部变量和上值；其布尔表达式恢复基于一篇已发表的反编译算法论文。它可处理单个文件或整个文件夹，输出 .lua 文件。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"flare-learning-hub","name":"FLARE Learning Hub","name_zh":"FLARE 学习中心","url":"https://github.com/mandiant/flare-learning-hub","evidence_url":"https://github.com/mandiant/flare-learning-hub/blob/ebd4e3a7dd71c0082db2748aba13e300447cd2e0/README.md","description_en":"Free English reverse-engineering and malware-analysis modules from Mandiant's FLARE team, published as Google Docs, with lab binaries, IDA databases and scripts kept in this repository. The Malware Analysis Crash Course builds from x86 basics to reading Windows API use through assembly-patching exercises and labs with worked solutions; the other modules introduce WinDbg Time Travel Debugging for malware triage and provide a reference to how Go 1.24 programs look in Windows executables.","description_zh":"Mandiant FLARE 团队发布的免费英文逆向工程与恶意软件分析课程模块，正文以 Google Docs 形式发布，实验用二进制文件、IDA 数据库和脚本存放在本仓库中。其中的恶意软件分析速成课从 x86 基础讲到解读 Windows API 调用，穿插汇编修改练习和附详细解答的实验；其余模块介绍如何用 WinDbg 时间旅行调试（Time Travel Debugging）分诊恶意软件，并提供一份说明 Go 1.24 程序在 Windows 可执行文件中呈现方式的参考手册。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"pokewalker-matching-decomp-case","name":"pw: a matching decompilation of the Pokéwalker firmware","name_zh":"pw：Pokéwalker 固件的一致性反编译重建","url":"https://github.com/lumirth/pw","evidence_url":"https://github.com/lumirth/pw/blob/6dc7bc09950078fa3fe0dffa4dae34e9549a99da/README.md","description_en":"Reconstructs as C the firmware of the Pokéwalker, the pedometer accessory for Pokémon HeartGold and SoulSilver, for its Renesas H8/38606 microcontroller. With artwork from the user’s retail firmware image and a supported Renesas compiler suite, the README reports a byte-identical rebuild of the 48 KiB image; without that image, original placeholder art gives a non-matching reference build. The author describes disassembling and decompiling the retail binary, the HeartGold/SoulSilver ROMs and the candidate compilers, alongside published hardware research.","description_zh":"以 C 语言重建 Pokéwalker 的固件。Pokéwalker 是《宝可梦 心金／魂银》配套的计步器配件，采用 Renesas H8/38606 微控制器。README 报告，使用从使用者自备的零售固件镜像中取得的美术素材及受支持的 Renesas 编译器套件，可重新构建出逐字节相同的 48 KiB 镜像；没有该镜像时，项目原创的占位美术只能生成不一致的参考构建。作者称其结合已公开的硬件研究，对零售二进制文件、心金／魂银 ROM 及候选编译器进行了反汇编和反编译。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","game"],"verified_at":"2026-10-19"},{"id":"slicer","name":"slicer","name_zh":"slicer 浏览器端 Java 逆向工具","url":"https://github.com/katana-project/slicer","evidence_url":"https://github.com/katana-project/slicer/blob/1881aae26eed58d12885a21305554aae2cb4ccc5/README.md","description_en":"Browser-based Java reverse-engineering tool that loads class files and JAR/ZIP archives and disassembles or decompiles them with Vineflower (the default), CFR, Procyon or JASM, compiled to run in the browser, next to its own bytecode disassembler. It draws inheritance and interface graphs and per-method control-flow graphs, searches constant-pool entries, instructions and member declarations or usages, applies Tiny, SRG/TSRG/CSRG or ProGuard mappings, and offers generic transformers that strip or normalize bytecode attributes so decompilers cope better with obfuscation. A JavaScript scripting API can add disassemblers and manipulate the workspace; the README itself recommends Recaf for serious reverse engineering.","description_zh":"基于浏览器的 Java 逆向工程工具：可加载 class 文件和 JAR/ZIP 归档，使用编译为可在浏览器中运行的 Vineflower（默认）、CFR、Procyon 或 JASM 进行反汇编或反编译，另有自带的字节码反汇编器。它能绘制继承与接口实现关系图以及单个方法的控制流图，搜索常量池条目、指令以及成员声明或使用位置，可应用 Tiny、SRG/TSRG/CSRG 或 ProGuard 映射，还提供剥离或规范化字节码属性的通用转换器，帮助反编译器更好地应对混淆。JavaScript 脚本 API 可添加反汇编器并操作工作区；README 自己也建议，若要进行严肃的逆向工程，应使用 Recaf。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"steamkit","name":"SteamKit","name_zh":"SteamKit Steam 网络协议库","url":"https://github.com/SteamRE/SteamKit","evidence_url":"https://github.com/SteamRE/SteamKit/blob/49387aec55c24104946af7a7b160148358e538b4/readme.md","description_en":".NET library that implements the client side of Valve’s Steam network protocol: connection-manager sessions, authentication, friends, unified service and Game Coordinator messages, Web API calls and CDN depot downloads. Message classes are generated from Steam protobufs tracked in a submodule and from the project’s own SteamLanguage definitions. Its Resources tree adds protocol-research tools: NetHook2, a Windows DLL that hooks a running Steam client to dump the network messages it exchanges, NetHookAnalyzer2 for viewing those dumps, and ProtobufDumper for recovering protobuf definitions from executables.","description_zh":"实现 Valve Steam 网络协议客户端的 .NET 库，涵盖连接管理服务器会话、身份验证、好友、统一服务消息与 Game Coordinator 消息、Web API 调用以及 CDN depot 下载。消息类由子模块跟踪的 Steam protobuf 和项目自有的 SteamLanguage 定义生成。其 Resources 目录还提供协议研究工具：NetHook2 是挂钩正在运行的 Steam 客户端、转储其收发网络消息的 Windows DLL，NetHookAnalyzer2 用于查看这些转储，ProtobufDumper 则从可执行文件中恢复 protobuf 定义。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["game","protocol"],"verified_at":"2026-10-19"},{"id":"nintendo-switch-joycon-re-notes","name":"Nintendo Switch Reverse Engineering","name_zh":"Nintendo Switch 逆向工程笔记","url":"https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering","evidence_url":"https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering/blob/b354f21ae81f7b0d1d060b2b61e66ad0d9bc1756/README.md","description_en":"Notes begun by dekuNukem in 2017 and extended by contributors on how the Joy-Con, Pro Controller and parts of the Switch console and dock work, worked out from teardowns, logic-analyzer captures and packet logs. Markdown files cover the Joy-Con board test points and rail-connector pinout, the wired serial handshake with its CRC-8 checksum, Bluetooth HID input and output reports with 32 documented subcommands, the USB HID commands of the Pro Controller and charging grip, the SPI flash memory map with stick and 6-axis calibration, IMU conversion formulas and rumble encoding tables. The repository also keeps STM32 test firmware that plays the console or a Joy-Con on the rail, a Wireshark dissector for the Bluetooth traffic, and the captures behind the notes.","description_zh":"由 dekuNukem 于 2017 年发起、众多贡献者陆续补充的笔记，记录 Joy-Con、Pro 手柄以及 Switch 主机与底座部分硬件的工作方式，依据来自拆机、逻辑分析仪抓取和数据包记录。各 Markdown 文件涵盖 Joy-Con 电路板测试点与滑轨接口引脚定义、带 CRC-8 校验的有线串口握手、蓝牙 HID 输入与输出报告及其中记录的 32 个子命令、Pro 手柄与充电握把的 USB HID 命令、含摇杆与六轴校准数据的 SPI 闪存布局、IMU 换算公式以及振动编码表。仓库还保存了在滑轨接口上扮演主机或 Joy-Con 的 STM32 测试固件、用于解析蓝牙流量的 Wireshark 解析器，以及笔记所依据的抓取数据。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["firmware","protocol"],"verified_at":"2026-10-19"},{"id":"android-app-re-101","name":"Android App Reverse Engineering 101","name_zh":"Android 应用逆向工程 101","url":"https://www.ragingrock.com/AndroidAppRE/","evidence_url":"https://github.com/maddiestone/AndroidAppRE/blob/17f9eeb5cb190d31cd90e9b9c7967978ea7a9d10/index.md","description_en":"Maddie Stone's free English workshop introducing static reverse engineering of Android apps, published as GitHub Pages. Its chapters cover app components and entry points, Dalvik bytecode and smali, decompiling DEX with jadx, finding and reading JNI native libraries in Ghidra, and string deobfuscation. Seven exercises with written solutions apply this to triaging malware samples and spotting command-execution flaws in pre-installed apps.","description_zh":"Maddie Stone 编写的免费英文工作坊，以 GitHub Pages 发布，入门讲解 Android 应用的静态逆向工程。各章涵盖应用组件与入口点、Dalvik 字节码与 smali、用 jadx 反编译 DEX、在 Ghidra 中定位并阅读 JNI 原生库，以及字符串去混淆。七个附书面解答的练习将这些方法用于分诊恶意软件样本，以及找出预装应用中的命令执行缺陷。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"wii-menu-ipl-decomp-case","name":"wii-ipl: a decompilation of the Wii Menu (System Menu 4.3)","name_zh":"wii-ipl：Wii Menu（System Menu 4.3）的反编译重建","url":"https://github.com/koopthekoopa/wii-ipl","evidence_url":"https://github.com/koopthekoopa/wii-ipl/blob/f4c09f4001c5a0b9af734ad1e3f80a54c5e5723c/README.md","description_en":"A work-in-progress decompilation of the Wii Menu, the console’s System Menu (IPL), targeting version 4.3 in its USA, European, Japanese and Korean builds. It recovers the menu’s own code together with the Revolution SDK, NintendoWare (NW4R), EGG and middleware libraries linked into it, matched unit by unit against the original executable with decomp-toolkit and objdiff. The repository holds no assets or assembly; a build needs the user’s own Wii Menu WAD and yields only main.dol.","description_zh":"Wii Menu（即主机的 System Menu，IPL）的反编译重建，仍在进行中，针对 4.3 版的美、欧、日、韩四个版本。项目重建菜单自身的代码，以及链接进其中的 Revolution SDK、NintendoWare（NW4R）、EGG 和中间件库，并借助 decomp-toolkit 与 objdiff 逐个编译单元与原可执行文件比对。仓库不含任何素材或汇编；构建需要使用者自己的 Wii Menu WAD，且只生成 main.dol。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","game"],"verified_at":"2026-10-19"},{"id":"usque-warp-masque-client-case","name":"usque: an open reimplementation of Cloudflare WARP’s MASQUE mode","name_zh":"usque：Cloudflare WARP MASQUE 模式的开源再实现","url":"https://github.com/Diniboy1123/usque","evidence_url":"https://github.com/Diniboy1123/usque/blob/6aa03fc97d12848dce34eedbd187fb1077b5d1ea/README.md","description_en":"Reimplements the MASQUE mode of Cloudflare’s WARP client in Go, tunnelling IP traffic over QUIC/HTTP/3 with Connect-IP (RFC 9484) and exposing it as a native TUN device, SOCKS5 or HTTP proxies, TCP-only L4 proxies or port forwarding. RESEARCH.md describes how the author worked out device enrollment, TLS client authentication and Cloudflare’s non-standard cf-connect-ip variant by analyzing the official Android client with Frida, mitmproxy, JADX, IDA Free and Wireshark. It registers with and connects to Cloudflare’s service outside the official client.","description_zh":"用 Go 重新实现 Cloudflare WARP 客户端的 MASQUE 模式：通过基于 QUIC/HTTP/3 的 Connect-IP（RFC 9484）隧道传输 IP 流量，并以原生 TUN 设备、SOCKS5 或 HTTP 代理、仅 TCP 的 L4 代理或端口转发等形式提供。RESEARCH.md 记录了作者如何借助 Frida、mitmproxy、JADX、IDA Free 和 Wireshark 分析官方 Android 客户端，弄清设备注册、TLS 客户端认证以及 Cloudflare 非标准的 cf-connect-ip 变体。它在官方客户端之外向 Cloudflare 服务注册并建立连接。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"awesome-unofficial-pc-ports","name":"awesome-unofficial-pc-ports","name_zh":"awesome-unofficial-pc-ports 非官方 PC 移植清单","url":"https://github.com/Sebastrion/awesome-unofficial-pc-ports","evidence_url":"https://github.com/Sebastrion/awesome-unofficial-pc-ports/blob/faef1ab57fa50446ca156bcbf085466dce9a9229/README.md","description_en":"A single-README guide to unofficial PC ports of console games built from decompilations or recompilations and chosen for easy installation by players. Its 76 game entries, grouped under Nintendo, PlayStation, Xbox, SEGA, Indie and J2ME, each recommend a port with short setup notes and often link the underlying decompilation and alternative ports; a Utilities section adds two recompilation launchers.","description_zh":"以单个 README 维护的非官方 PC 移植指南，收录基于反编译或重编译、且便于玩家安装的主机游戏移植。76 个游戏条目按 Nintendo、PlayStation、Xbox、SEGA、独立游戏和 J2ME 分组，每项推荐一个移植版并附简短安装说明，常同时链接所依据的反编译项目和其他移植版；“实用工具”部分另列两个重编译启动器。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["game"],"verified_at":"2026-10-19"},{"id":"re-ios-apps-course","name":"Reverse Engineering iOS Applications","name_zh":"iOS 应用逆向工程课程","url":"https://github.com/ivRodriguezCA/RE-iOS-Apps","evidence_url":"https://github.com/ivRodriguezCA/RE-iOS-Apps/blob/183873adea6b07f951e1b49565000e2c83448429/README.md","description_en":"Ivan Rodriguez's free English course (version 1.1) on reverse engineering iOS applications, aimed at beginners in iOS app security. Five Markdown modules cover setting up a jailbroken test device, decrypting App Store apps for analysis, static analysis of an IPA's files, frameworks, Objective-C classes and ARM binary in Hopper or Ghidra, runtime analysis with Cycript and Frida, and binary patching in Hopper. Exercises use CoinZa, a deliberately insecure Objective-C app the author built from vulnerability classes he reports finding in production App Store apps.","description_zh":"Ivan Rodriguez 编写的免费英文课程（1.1 版），讲解 iOS 应用逆向工程，面向 iOS 应用安全初学者。五个 Markdown 模块依次介绍越狱测试设备的环境配置、为分析而解密 App Store 应用、对 IPA 中的文件、框架、Objective-C 类和 ARM 二进制进行静态分析（使用 Hopper 或 Ghidra）、用 Cycript 和 Frida 做运行时分析，以及在 Hopper 中修补二进制。练习使用 CoinZa：作者根据其所述在 App Store 正式应用中发现的漏洞类型，专门编写的一个故意不安全的 Objective-C 应用。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"webamp-winamp-reimplementation-case","name":"Webamp: a browser reimplementation of Winamp 2","name_zh":"Webamp：在浏览器中重新实现 Winamp 2","url":"https://github.com/captbaritone/webamp","evidence_url":"https://github.com/captbaritone/webamp/blob/f01369fc2d7aaa9366a3ba9ab0ad1db4b6417a40/README.md","description_en":"Reimplements Winamp 2's main, equalizer and playlist windows in HTML5 and JavaScript, with Web Audio playback, volume, balance and equalizer, and renders original classic .wsz skins, which its documentation says match Winamp 2.9 pixel for pixel; Milkdrop presets run through the Butterchurn WebGL port. It ships as the webamp npm module for embedding in web pages, and the same monorepo runs webamp.org and the skins.webamp.org skin museum. Its webamp-modern prototype targets Winamp 3/5 modern skins with an interpreter for MAKI skin scripts, whose undocumented bytecode format the author reverse engineered and documents in the repository.","description_zh":"用 HTML5 和 JavaScript 重新实现 Winamp 2 的主窗口、均衡器和播放列表窗口，借助 Web Audio 实现播放、音量、声道平衡和均衡器，并渲染原有的经典 .wsz 皮肤，其文档称渲染效果与 Winamp 2.9 逐像素一致；Milkdrop 预设通过 Butterchurn 的 WebGL 移植版运行。它以 webamp npm 模块的形式发布，可嵌入网页，同一 monorepo 还运行着 webamp.org 和 skins.webamp.org 皮肤博物馆。其中的 webamp-modern 原型面向 Winamp 3/5 的现代皮肤，内含 MAKI 皮肤脚本解释器；MAKI 字节码格式原本没有公开文档，作者对其进行了逆向分析，并在仓库中写成文档。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-19"},{"id":"nforest-awesome-decompilation","name":"awesome-decompilation","name_zh":"awesome-decompilation 反编译阅读清单","url":"https://github.com/nforest/awesome-decompilation","evidence_url":"https://github.com/nforest/awesome-decompilation/blob/8731870b99d1816ed6979ab5745ae42b4bf73018/README.md","description_en":"A short, link-only reading list on decompiling machine code, last updated in 2023. Its 45 links cover foundational theses, compiler and program-analysis books, decompiler products and projects, pipeline topics from intermediate representations to type, control-flow and identifier recovery, early neural-decompilation papers and binary-to-source matching.","description_zh":"篇幅不长、只列链接的机器码反编译阅读清单，最近一次更新在 2023 年。45 个链接涵盖奠基性学位论文、编译器与程序分析书籍、反编译器产品和项目，从中间表示到类型、控制流和标识符恢复的反编译流程主题，早期神经网络反编译论文，以及二进制与源码匹配。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"tiny-dec","name":"tiny-dec","name_zh":"tiny-dec 教学用反编译器","url":"https://github.com/ZhangZhuoSJTU/tiny-dec","evidence_url":"https://github.com/ZhangZhuoSJTU/tiny-dec/blob/4f5f1e00a147ba1c1471d2e01f9dd4beb5a693d6/README.md","description_en":"Zhuo Zhang's small educational decompiler for 32-bit RISC-V (RV32I) ELF files, written in Python to teach how decompilation works rather than to compete with production decompilers. Its 19 deliberately separate stages run from ELF loading, decoding and p-code lifting through SSA, stack, type, variable and range recovery to control-flow structuring and C output, and the CLI can stop at any stage to print that stage's intermediate result. The README also offers a Claude Code plugin whose AI tutor walks learners through the stages with quizzes and exercises.","description_zh":"Zhuo Zhang 用 Python 编写的小型教学用反编译器，面向 32 位 RISC-V（RV32I）ELF 文件，目的是讲清反编译的工作原理，而非与生产级反编译器竞争。它把流程刻意拆成 19 个独立阶段：从 ELF 加载、指令解码和 p-code 提升，经过 SSA、栈、类型、变量和取值范围恢复，再到控制流结构化和 C 代码输出；命令行可在任一阶段停下，打印该阶段的中间结果。README 还提供一个 Claude Code 插件，其中的 AI 导师会结合小测和练习，带学习者逐个阶段学习。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"sead-nintendo-library-decomp-case","name":"sead: a decompilation of Nintendo’s first-party C++ standard library","name_zh":"sead：Nintendo 第一方 C++ 标准库的反编译重建","url":"https://github.com/open-ead/sead","evidence_url":"https://github.com/open-ead/sead/blob/f4178a21e21235830357dc27c26a2c29956972ed/README.md","description_en":"Decompiles sead, the C++ standard library that Nintendo statically links into its first-party games, covering containers, heaps, strings, math, file devices, threads, the game framework and graphics. Compile-time presets target the recent versions used by Breath of the Wild, Super Mario Odyssey, Splatoon 3, Tears of the Kingdom and Super Mario Bros. Wonder, and game decompilations such as Breath of the Wild pull it in as a submodule. Names come from debugging symbols and assertions in retail titles, and the README warns that many inlined and templated names are guesses.","description_zh":"反编译 sead，即 Nintendo 静态链接进其第一方游戏的 C++ 标准库，涵盖容器、堆、字符串、数学、文件设备、线程、游戏框架和图形等模块。编译期预设针对《旷野之息》《超级马力欧 奥德赛》《斯普拉遁 3》《王国之泪》和《超级马力欧兄弟 惊奇》所用的较新版本，《旷野之息》等游戏反编译项目以子模块方式引入它。命名来自零售游戏中的调试符号和断言，README 也提醒许多内联与模板函数的名称只是猜测。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"teddycloud-toniebox-server-case","name":"TeddyCloud: a self-hosted replacement for the Toniebox cloud","name_zh":"TeddyCloud：可自托管的 Toniebox 云端替代服务器","url":"https://github.com/toniebox-reverse-engineering/teddycloud","evidence_url":"https://github.com/toniebox-reverse-engineering/teddycloud/blob/78c3b38e36f665d3a5fffe907f73a02725176377/README.md","description_en":"Reimplements the Boxine cloud services a Toniebox talks to as a self-hosted C server, so the box can fetch audio, settings and over-the-air content locally while the owner controls what reaches the manufacturer. It serves and caches tonie audio, converts other audio into the box’s TAF format, can pass requests through to the original cloud, and adds a web interface, MQTT and Home Assistant integration. Protobuf definitions in the repository describe the box’s freshness-check, RTNL log and TAF header messages.","description_zh":"以可自托管的 C 服务器重新实现 Toniebox 所连接的 Boxine 云服务，使盒子能在本地获取音频、设置和无线下发内容，同时由用户控制哪些数据发往厂商。它可提供并缓存 tonie 音频，把其他音频转换为盒子使用的 TAF 格式，可将请求透传到原云端，并提供网页界面、MQTT 及 Home Assistant 集成。仓库中的 protobuf 定义描述了盒子的 freshness-check、RTNL 日志和 TAF 头部报文。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","protocol"],"verified_at":"2026-10-19"},{"id":"onethawt-re-reading-list","name":"Reverse Engineering Reading List","name_zh":"逆向工程阅读清单（onethawt）","url":"https://github.com/onethawt/reverseengineering-reading-list","evidence_url":"https://github.com/onethawt/reverseengineering-reading-list/blob/a1ee767b5cf8504c398763b2b6304c20507ef1e3/README.md","description_en":"A short reading list, compiled by One Thawt mostly in 2015–2016, of about 58 links to reverse-engineering tools, books, papers, talks and blog posts, kept in a README and a separate malware-analysis page. Sections run from disassemblers and debuggers, beginner talks and classic books through data-structure recovery papers, instruction-set references, iOS, Android and Windows material, unpacking, deobfuscation and protocol inference from network traces.","description_zh":"由 One Thawt 编写的简短阅读清单，主要成形于 2015–2016 年，在一个 README 和单独的恶意软件分析页面中收录约 58 个链接，涵盖逆向工程工具、书籍、论文、演讲和博客文章。各部分从反汇编器与调试器、入门讲座和经典书籍，到数据结构恢复论文、指令集参考资料、iOS、Android 与 Windows 相关资料、脱壳、反混淆，以及基于网络流量的协议推断。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"animal-forest-n64-decomp-case","name":"Animal Forest: an in-progress matching N64 decompilation","name_zh":"《动物之森》：进行中的 N64 一致性反编译","url":"https://github.com/zeldaret/af","evidence_url":"https://github.com/zeldaret/af/blob/4ddba04604ee7b4c4cfc0b64f8ee4d094bb385be/README.md","description_en":"Rebuilds the Japanese Nintendo 64 release of Animal Forest (Dōbutsu no Mori) from C code reverse-engineered from the ROM, combined with assets and assembly extracted from a user-supplied ROM. Default builds compare the uncompressed and recompressed ROMs with stored MD5 checksums. The README rules out use as a port base or for commercial purposes, and decomp.dev reported 18.52% of code matched at the reviewed commit.","description_zh":"将从 ROM 逆向得到的 C 代码与从使用者自备 ROM 中提取的素材和汇编结合，重建日版 Nintendo 64《动物之森》（どうぶつの森）。默认构建会用仓库保存的 MD5 校验未压缩与重新压缩的 ROM。README 明确该项目不作为移植基础，也不用于商业目的；decomp.dev 报告所审提交有 18.52% 的代码已匹配。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"remade-reimplementation-directory","name":"Remade","name_zh":"Remade 软件重新实现目录","url":"https://github.com/replicraft/remade","evidence_url":"https://github.com/replicraft/remade/blob/ea8119f01c2fab14ef9e0c23a7d348b0a86660ff/README.md","description_en":"The source repository of remade.wiki, a community-curated directory of open-source reimplementations of closed-source software, mostly creative, productivity and engineering applications. Each listing is a YAML record naming the original software, languages, platforms, license and self-reported status, compatibility and limitations, and the directory also tracks requests for software nobody has reimplemented yet.","description_zh":"remade.wiki 的源码仓库。remade.wiki 是由社区整理的目录，收录闭源软件的开源重新实现，以创意、办公和工程类应用为主。每个条目是一份 YAML 记录，注明被重现的原软件、编程语言、平台、许可证，以及自报的开发状态、兼容程度和局限；目录还收集尚无人重新实现的软件请求。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["app"],"verified_at":"2026-10-19"},{"id":"pixmob-ir-protocol-case","name":"PixMob IR reverse engineering: controlling event wristbands at home","name_zh":"PixMob 红外逆向工程：在家控制活动手环","url":"https://github.com/danielweidman/pixmob-ir-reverse-engineering","evidence_url":"https://github.com/danielweidman/pixmob-ir-reverse-engineering/blob/b372420e1e1ff818a8d25ba50f0c71e97e62f138/README.md","description_en":"Recovers enough of the infrared protocol used by PixMob event wristbands to light them at home, starting from Flipper Zero recordings made at concerts and games and replaying them to bracelets. Pulse-timing analysis found 38 kHz signals with bit intervals of roughly 700 µs, and targeted brute forcing from an ESP32 discovered hundreds of colour, fade, random and motion-mode commands, now sent through Arduino, Python and web tools. The README calls the result far from exhaustive and points to a later repository that decoded most of the full IR protocol through MCU dumping.","description_zh":"从在演唱会和球赛现场用 Flipper Zero 录下的信号出发，把录音重放给手环，恢复出足以在家中点亮 PixMob 活动手环的部分红外协议。脉冲时序分析发现信号载波为 38 kHz、比特间隔约 700 微秒；项目再用 ESP32 做有针对性的暴力枚举，找到数百条颜色、渐变、随机和体感模式命令，现可通过 Arduino、Python 和网页工具发送。README 称这些结果远未穷尽，并指向一个后来通过 MCU 转储基本解出完整红外协议的仓库。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"wtsxdev-reverse-engineering-list","name":"Reverse Engineering resources (wtsxDev)","name_zh":"Reverse Engineering resources 逆向工程资源清单（wtsxDev）","url":"https://github.com/wtsxDev/reverse-engineering","evidence_url":"https://github.com/wtsxDev/reverse-engineering/blob/b25498551c6d7110685896078afeb27097aa1e24/README.md","description_en":"A single-README awesome list, started in January 2017 and maintained under the KaliTut name, of 139 reverse-engineering links in 16 sections: books, courses, practice targets, hex editors, binary-format tools, disassemblers, binary analysis, bytecode analysis, import reconstruction, dynamic analysis, debugging, Mac decryption, document analysis, scripting, Android and YARA. Entries are mostly a tool or resource name with its link, a few with a one-line usage note, and lean towards Windows and macOS tooling and malware analysis.","description_zh":"以单个 README 维护的 awesome 清单，2017 年 1 月创建，以 KaliTut 名义维护，共收录 139 个逆向工程链接，分为 16 个部分：书籍、课程、练习目标、十六进制编辑器、二进制格式工具、反汇编器、二进制分析、字节码分析、导入表重建、动态分析、调试、Mac 解密、文档分析、脚本、Android 和 YARA。条目大多只有工具或资源名称及链接，少数附一行用法说明，内容偏重 Windows 与 macOS 工具以及恶意软件分析。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"decomp-academy","name":"Decomp Academy","name_zh":"Decomp Academy 一致性反编译课程","url":"https://decomp-academy.dev/","evidence_url":"https://github.com/JackPriceBurns/decomp-academy-fe/blob/a21f9d00dcdcb00936c3f0369f396b555e893d93/README.md","description_en":"A free, English, in-browser course in matching decompilation maintained by Jack Price-Burns: learners read a function's target assembly, write C, and the original console compiler grades the result byte for byte. Lessons build from reading registers and arithmetic through control flow, structs, floating point, the ABI, globals, optimizer behaviour and 64-bit integers, then finish with functions adapted from open-source decompilation projects. The curriculum now spans GameCube PowerPC, Game Boy Advance Thumb and Nintendo 64 MIPS courses, and the frontend source is on GitHub.","description_zh":"由 Jack Price-Burns 维护的免费英文在线课程，在浏览器中教授一致性反编译：学习者阅读函数的目标汇编，编写 C 代码，再由原版主机编译器逐字节评判结果。课程从读寄存器和算术运算讲起，依次覆盖控制流、结构体、浮点、ABI、全局变量、优化器行为和 64 位整数，最后以改编自开源反编译项目的函数收尾。课程目前包括 GameCube PowerPC、Game Boy Advance Thumb 和 Nintendo 64 MIPS 三门，前端源码公开在 GitHub 上。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"phantom-hourglass-ds-decomp-case","name":"Phantom Hourglass: an early-stage matching Nintendo DS decompilation","name_zh":"《幻影沙漏》：早期阶段的 Nintendo DS 一致性反编译","url":"https://github.com/zeldaret/ph","evidence_url":"https://github.com/zeldaret/ph/blob/f0799bd6038be6858499ec68f0d03cdbbfa53d0b/README.md","description_en":"Recreates C++ source for The Legend of Zelda: Phantom Hourglass by hand-decompiling its European and US Nintendo DS releases, using the dsd toolkit to delink code from a user-supplied ROM and rebuild the ROM. objdiff tracks matches function by function, and the default build compares the output ROM with a stored SHA-1. The work is at an early stage: decomp.dev reported 2.82% of code matched at the reviewed commit.","description_zh":"通过手工反编译，为《塞尔达传说 幻影沙漏》的欧版与美版 Nintendo DS 重建 C++ 源码：借助 dsd 工具集从使用者自备的 ROM 中拆分代码，再重新构建 ROM。objdiff 逐个函数跟踪匹配情况，默认构建会将输出 ROM 与仓库保存的 SHA-1 比对。项目仍处于早期阶段：decomp.dev 报告所审提交有 2.82% 的代码已匹配。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"kinoko-mkwii-physics-reimplementation-case","name":"Kinoko: reimplementing Mario Kart Wii’s physics engine for exact ghost replay","name_zh":"Kinoko：为精确回放幽灵记录而重新实现 Mario Kart Wii 物理引擎","url":"https://github.com/vabold/Kinoko","evidence_url":"https://github.com/vabold/Kinoko/blob/550c97a299c4de4a9f7cb90bc79cf8c7c768557c/README.md","description_en":"Re-implements Mario Kart Wii’s physics engine in C++ as a command-line simulator, continuing stblr/Hanachan’s goal of perfectly accurate time-trial ghost replay. Each test case replays a recorded ghost through the engine and compares kart position, rotation, velocities, speed and checkpoint state frame by frame with a trace captured from the original game. It is a behavioural reimplementation of the physics only, not a matching decompilation, and has no graphical frontend.","description_zh":"以 C++ 将 Mario Kart Wii 的物理引擎重新实现为命令行模拟器，延续 stblr/Hanachan 的目标：完全准确地回放计时赛幽灵记录。每个测试用例让引擎重放一条幽灵记录，并逐帧将赛车的位置、旋转、速度向量、速率和检查点状态与从原版游戏采集的轨迹比较。它只在行为层面重新实现物理部分，并非一致性反编译，也没有图形前端。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"owasp-fstm","name":"OWASP Firmware Security Testing Methodology (FSTM)","name_zh":"OWASP 固件安全测试方法论（FSTM）","url":"https://scriptingxss.gitbook.io/firmware-security-testing-methodology/","evidence_url":"https://github.com/scriptingxss/owasp-fstm/blob/ec666e8f8b9f7618a248a1c354469893abf0edb2/README.md","description_en":"A free English methodology, maintained by Aaron Guzman and published on GitBook, for security testing and reverse engineering embedded-device firmware. It is organized as nine stages: information gathering, obtaining firmware, analyzing the image, extracting the filesystem, static analysis of its contents, emulation, dynamic testing, runtime analysis and binary exploitation, with example commands for tools such as binwalk, unblob, FACT, EMBA, Firmwalker, QEMU and Ghidra. An October 2025 revision added C/C++ static-analysis tools, SBOM generation and a mapping to the OWASP IoT Security Verification Standard (ISVS).","description_zh":"由 Aaron Guzman 维护、发布在 GitBook 上的免费英文方法论，用于嵌入式设备固件的安全测试与逆向工程。全文分为九个阶段：信息收集、获取固件、分析固件镜像、提取文件系统、静态分析文件系统内容、仿真、动态测试、运行时分析和二进制漏洞利用，并给出 binwalk、unblob、FACT、EMBA、Firmwalker、QEMU 和 Ghidra 等工具的示例命令。2025 年 10 月的修订加入了 C/C++ 静态分析工具、SBOM 生成，以及与 OWASP IoT 安全验证标准（ISVS）的对应关系。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"awesome-android-reverse-engineering","name":"Awesome Android Reverse Engineering","name_zh":"Awesome Android Reverse Engineering Android 逆向工程资源清单","url":"https://github.com/user1342/Awesome-Android-Reverse-Engineering","evidence_url":"https://github.com/user1342/Awesome-Android-Reverse-Engineering/blob/0ade43d6b46ff19675ca4d8b8f1cc098e1af73b8/README.md","description_en":"An awesome list of Android reverse-engineering training, tools and resources started in 2023 by James Stevenson, with 92 one-line entries, 16 of them starred as great and up to date. It covers courses, videos and books; static analysis and deobfuscation, networking and Frida-based instrumentation, decompilers and malware analysis tools; documentation and case studies; CTFs and crackmes; obfuscation and anti-reversing; and a short firmware and kernel section.","description_zh":"James Stevenson 于 2023 年创建的 awesome 清单，收录 Android 逆向工程的培训、工具和资源，共 92 个单行条目，其中 16 个以星标注为优质且较新的资源。内容涵盖课程、视频和书籍，静态分析与反混淆、网络分析与基于 Frida 的插桩、反编译器和恶意软件分析工具，文档与案例研究，CTF 与 crackme，混淆与反逆向，以及一个简短的固件与内核部分。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["app"],"verified_at":"2026-10-19"},{"id":"mario-kart-double-dash-decomp-case","name":"Mario Kart: Double Dash!!: a matching GameCube decompilation of the debug build","name_zh":"《马力欧卡丁车：双重冲刺!!》：调试版 GameCube 一致性反编译","url":"https://github.com/doldecomp/mkdd","evidence_url":"https://github.com/doldecomp/mkdd/blob/1d2918ca577817ba431baddb78dda24831e0e0bb/README.md","description_en":"A work-in-progress 1:1 decompilation of Mario Kart: Double Dash!! that rebuilds the GameCube main.dol of the US debug build (MarioClub_us) from C and C++ with the original Metrowerks compilers, checking it against a stored SHA-1. The build splits the binary from a user-supplied disc image, and objdiff compares objects during development. decomp.dev reported 47.09% of code matched at the reviewed commit; a European retail target is configured but marked as not working yet.","description_zh":"《马力欧卡丁车：双重冲刺!!》的进行中 1:1 反编译：用原版 Metrowerks 编译器从 C 与 C++ 源码重建美版调试构建（MarioClub_us）的 GameCube main.dol，并与仓库保存的 SHA-1 比对。构建从使用者自备的光盘镜像中拆分二进制，开发时用 objdiff 比对目标文件。decomp.dev 报告所审提交有 47.09% 的代码已匹配；欧版零售目标虽已配置，但标注为尚不可用。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"sfiii-3rd-strike-ps2-decomp-case","name":"3S Decomp: a byte-compared PS2 decompilation of Street Fighter III: 3rd Strike","name_zh":"3S Decomp：逐字比对的《街头霸王 III：3rd Strike》PS2 反编译重建","url":"https://github.com/crowded-street/3s-decomp","evidence_url":"https://github.com/crowded-street/3s-decomp/blob/be9b9bc69dc19822a8eca9ce3e72ba560d5a3835/README.md","description_en":"Decompiles the PlayStation 2 executable of Street Fighter III: 3rd Strike from Street Fighter Anniversary Collection into C that period Metrowerks and EE GCC compilers rebuild, then compares the rebuilt executable word by word with the user’s original. README reports the game code fully decompiled and the CRI middleware partly so. The separate 3SX native port describes itself as this project’s continuation.","description_zh":"将 Street Fighter Anniversary Collection 中《街头霸王 III：3rd Strike》的 PlayStation 2 可执行文件反编译为 C 源码，用当年的 Metrowerks 与 EE GCC 编译器重新构建，再将重建出的可执行文件与使用者自备的原文件逐字比较。README 报告游戏代码已全部反编译，CRI 中间件部分完成。另有独立的 3SX 原生移植，自称是本项目的延续。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"halo-ce-xbox-reimplementation-case","name":"Halo: Combat Evolved: an incremental re-implementation patched into the original Xbox executable","name_zh":"Halo: Combat Evolved：逐步重新实现并修补进原版 Xbox 可执行文件","url":"https://github.com/halo-re/halo","evidence_url":"https://github.com/halo-re/halo/blob/21bc641df6b8bdd730c23885ff643545423dcc82/README.md","description_en":"A research project re-implementing the original Xbox Halo: Combat Evolved in C, one function at a time. Rewritten functions are compiled into a separate image and patched into the user’s original executable with redirects from the original implementations, so the hybrid game can be run and debugged in xemu or on an Xbox as work progresses. The project reports an early stage, and its sources document no byte-for-byte comparison with the original code.","description_zh":"一个以 C 语言逐个函数重新实现初代 Xbox 版 Halo: Combat Evolved 的研究项目。重写的函数编译为独立映像，再修补进使用者自备的原版可执行文件，并从原有实现重定向过去，使这一混合版本能在开发过程中于 xemu 或 Xbox 上运行和调试。项目自述仍处于早期阶段，其来源也未记录与原代码的逐字节比较。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"paper-mario-ttyd-decomp-case","name":"Paper Mario: The Thousand-Year Door: an early matching GameCube decompilation","name_zh":"《纸片马力欧 RPG》：早期阶段的 GameCube 一致性反编译","url":"https://github.com/doldecomp/ttyd","evidence_url":"https://github.com/doldecomp/ttyd/blob/62131fc31866f85a12e4817a8dc37f0c25eb5f8c/README.md","description_en":"A work-in-progress matching decompilation of Paper Mario: The Thousand-Year Door that targets the Japanese Rev 0 GameCube release (G8MJ01), rebuilding MarioSt.dol and 31 REL modules with the original Metrowerks compilers and checking each against a stored SHA-1. The build splits these binaries from a user-supplied disc image, and objdiff compares objects during development. decomp.dev reported 12.10% of code matched at the reviewed commit.","description_zh":"《纸片马力欧 RPG》（Paper Mario: The Thousand-Year Door）的进行中一致性反编译，目标为日版 Rev 0 GameCube 版本（G8MJ01）：用原版 Metrowerks 编译器重建 MarioSt.dol 和 31 个 REL 模块，并逐一与仓库保存的 SHA-1 比对。构建从使用者自备的光盘镜像中拆分这些二进制，开发时用 objdiff 比对目标文件。decomp.dev 报告所审提交有 12.10% 的代码已匹配。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"awesome-frida","name":"Awesome Frida","name_zh":"Awesome Frida Frida 资源清单","url":"https://github.com/dweinstein/awesome-frida","evidence_url":"https://github.com/dweinstein/awesome-frida/blob/e20da3b2ae3a30cd65ab0e4a0f0345bb909ecb10/README.md","description_en":"An awesome list of libraries, scripts, tools, talks and articles built on or about Frida, the dynamic instrumentation toolkit, started by David Weinstein in May 2016. Its 82 entries fall into libraries (about half of them NowSecure Node.js modules), script collections and projects, talks and papers, tools powered by Frida such as r2frida, objection, friTap and Fridump, videos, blog posts and community links, most with a one-line summary.","description_zh":"David Weinstein 于 2016 年 5 月创建的 awesome 清单，收录基于或围绕动态插桩工具包 Frida 的程序库、脚本、工具、演讲和文章。全部 82 个条目分为程序库（约一半是 NowSecure 的 Node.js 模块）、脚本合集与项目、演讲与论文、基于 Frida 的工具（如 r2frida、objection、friTap 和 Fridump）、视频、博客文章以及社区链接，大多附有一行简介。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"3sx-third-strike-native-port-case","name":"3SX: a native Street Fighter III: 3rd Strike port continuing the PS2 decompilation","name_zh":"3SX：延续 PS2 反编译的《街头霸王 III：3rd Strike》原生移植","url":"https://github.com/crowded-street/3sx","evidence_url":"https://github.com/crowded-street/3sx/blob/bdc2cd351aad35d7e251a5a6d63a3368bd31cbaa/README.md","description_en":"Builds Street Fighter III: 3rd Strike as native C for Windows, macOS and Linux, continuing the 3s-decomp PS2 decompilation, with SDL3 for video, input and audio and GekkoNet for rollback netplay. README stresses that it is neither a recompilation nor emulation. The port needs the player’s own PS2 game files and works toward arcade-accurate balance, which an optional Statcheck build tests against CPS3 RAM states recorded from Fightcade replays.","description_zh":"延续 3s-decomp 的 PS2 反编译成果，将《街头霸王 III：3rd Strike》构建为可在 Windows、macOS 和 Linux 上运行的原生 C 程序，以 SDL3 处理画面、输入和声音，以 GekkoNet 实现回滚联机。README 强调它既不是重编译，也不是模拟。移植版需要玩家自备 PS2 游戏文件，并以接近街机版的平衡性为目标；可选的 Statcheck 构建会用 Fightcade 对战录像中记录的 CPS3 内存状态来检验这一点。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"re4-gamecube-debug-decomp-case","name":"re4: a byte-identical decompilation of the Resident Evil 4 GameCube debug build","name_zh":"re4：Resident Evil 4 GameCube 调试版的字节一致反编译","url":"https://github.com/adonis-singh/re4","evidence_url":"https://github.com/adonis-singh/re4/blob/9b76ff003081d6ece8b838453fb8310743a972c7/README.md","description_en":"Reconstructs C and C++ source for the two-disc Resident Evil 4 GameCube debug prototype (G4BE08) and rebuilds main.dol and all 114 REL overlays with the compilers the README names, checking every output against a SHA-1 list. Function names are Capcom’s own from the debug build’s Bio4.sym files, and most struct and field names are aligned from the PS2 debug build’s debug information. The project’s research log says AI agents did the matching work; byte identity is project-reported.","description_zh":"为 Resident Evil 4 的双光盘 GameCube 调试原型版（G4BE08）重建 C 与 C++ 源码，并用 README 所列编译器重新构建 main.dol 及全部 114 个 REL 覆盖模块，逐一与 SHA-1 清单比对。函数名沿用调试版 Bio4.sym 符号文件中 Capcom 自己的命名，多数结构体与字段名则依据 PS2 调试版的调试信息对齐得出。项目的研究日志称一致性工作由 AI 智能体完成；字节一致为项目报告的结果。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"smash-bros-brawl-decomp-case","name":"Super Smash Bros. Brawl: an early matching Wii decompilation","name_zh":"《任天堂明星大乱斗X》：早期阶段的 Wii 一致性反编译","url":"https://github.com/doldecomp/brawl","evidence_url":"https://github.com/doldecomp/brawl/blob/b96b501ff127b29e8946ee9a352a7bdc2ef5f38a/README.md","description_en":"A work-in-progress matching decompilation of Super Smash Bros. Brawl that targets the USA Rev 2 Wii release (RSBE01_02), splitting main.dol and 126 REL modules from a user-supplied disc image and checking the rebuilt binaries against stored SHA-1 values. objdiff compares objects during development, and six other regional revisions are listed but commented out of the supported set. decomp.dev reported 1.27% of code matched at the reviewed commit.","description_zh":"《任天堂明星大乱斗X》（Super Smash Bros. Brawl）的进行中一致性反编译，目标为美版 Rev 2 Wii 版本（RSBE01_02）：从使用者自备的光盘镜像中拆分 main.dol 和 126 个 REL 模块，并按仓库保存的 SHA-1 校验重建出的二进制。开发时用 objdiff 比对目标文件；另外六个地区修订版虽已列出，但在支持列表中被注释掉。decomp.dev 报告所审提交有 1.27% 的代码已匹配。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"re-plants-vs-zombies-decomp-case","name":"re-plants-vs-zombies: decompiling and modernizing Plants vs. Zombies GOTY","name_zh":"re-plants-vs-zombies：反编译并现代化改造 Plants vs. Zombies 年度版","url":"https://github.com/Patoke/re-plants-vs-zombies","evidence_url":"https://github.com/Patoke/re-plants-vs-zombies/blob/c4692036c5e11d227c8fb7c593b734dac96da028/README.md","description_en":"Reconstructs C++ source for Plants vs. Zombies on PopCap’s open-source SexyAppFramework, starting from an earlier community decompilation of version 0.9.9 and adding functionality reversed from the Game of the Year edition, with functions annotated by GOTY addresses. The project also modernizes the engine with current C++ and is replacing the DirectDraw and Direct3D 7 renderers with GLFW. It builds a fan executable that runs from an original game folder, aiming at a modernized, extensible game rather than an identical binary.","description_zh":"以 PopCap 开源的 SexyAppFramework 为基础重建 Plants vs. Zombies 的 C++ 源码：起点是社区早先对 0.9.9 版的反编译，再补入从年度版（GOTY）逆向得到的功能，并以 GOTY 版地址标注函数。项目同时以现代 C++ 改造引擎，并正将 DirectDraw 与 Direct3D 7 渲染器替换为 GLFW。它构建出在原版游戏目录中运行的同人可执行文件，目标是现代化、可扩展的游戏，而不是完全一致的二进制。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"awesome-ghidra","name":"Awesome Ghidra","name_zh":"Awesome Ghidra Ghidra 资源清单","url":"https://github.com/AllsafeCyberSecurity/awesome-ghidra","evidence_url":"https://github.com/AllsafeCyberSecurity/awesome-ghidra/blob/9265b2f730a10f6261945ac22cb295c8f6038f87/README.md","description_en":"An awesome list of Ghidra scripts, plugins, extensions, learning materials and related services, kept by the Allsafe GitHub organization since December 2019. Its 49 entries comprise 36 scripts and extensions, from malware-analysis and crypto-constant finders to Go, JNI, EVM and EFI helpers, Python and Jupyter bridges, P-code emulation and patch-diff correlators; 10 books, talks and courses; and three related projects such as r2ghidra-dec and Ghidraaas, each with a one-line summary.","description_zh":"由 GitHub 组织 Allsafe 自 2019 年 12 月起维护的 awesome 清单，收录 Ghidra 脚本、插件、扩展、学习资料和相关服务。全部 49 个条目包括 36 个脚本与扩展，从恶意软件分析和加密常量查找工具，到 Go、JNI、EVM 和 EFI 辅助工具、Python 与 Jupyter 桥接、P-code 模拟以及补丁对比关联器；10 份书籍、演讲和课程资料；以及 r2ghidra-dec、Ghidraaas 等 3 个相关项目，每项附一行简介。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"sonic-advance-1-2-decomp-port-case","name":"Sonic Advance 1 & 2: a matching GBA decompilation with widescreen ports","name_zh":"《索尼克 Advance》1 与 2：一致性 GBA 反编译及宽屏移植","url":"https://github.com/SAT-R/sa2","evidence_url":"https://github.com/SAT-R/sa2/blob/393357f7c9d46b5c10b6c41a57b80fe3b58f3c8d/README.md","description_en":"Reconstructs Sonic Advance and Sonic Advance 2 for the Game Boy Advance as C that rebuilds six hash-listed ROMs with SAT-R’s agbcc fork, and compiles the same code into widescreen SDL ports for Linux, macOS and Windows plus PSP and PS2 builds. README reports Sonic Advance 2 built entirely from C with about 60 functions still non-matching. Extracted graphics, music and data are committed, so the builds read no original ROM.","description_zh":"将 Game Boy Advance 版《索尼克 Advance》和《索尼克 Advance 2》重建为 C 源码，借助 SAT-R 的 agbcc 分支重新构建六个列有哈希值的 ROM，同一套代码还可编译为面向 Linux、macOS 和 Windows 的宽屏 SDL 移植版，以及 PSP 和 PS2 版本。README 报告《索尼克 Advance 2》已全部由 C 构建，仍有约 60 个函数不一致。提取出的图像、音乐和数据都提交在仓库中，因此构建时不读取原 ROM。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"paleblood-bloodborne-functional-decomp-case","name":"Paleblood: a functional decompilation of Bloodborne with its own runtime","name_zh":"Paleblood：带自有运行时的 Bloodborne 功能等价反编译","url":"https://github.com/Yharnam-Hunters/Paleblood","evidence_url":"https://github.com/Yharnam-Hunters/Paleblood/blob/1d418eba692745d8fc0a7d77a04d1bca56badab8/README.md","description_en":"Rewrites code from Bloodborne’s PS4 executable (CUSA03173 with update 1.09) as readable C++, one function at a time, aiming at a native PC source port on a clean-room runtime of its own. It is a functional rather than matching decompilation: each replacement is hooked in, compared with the original machine code on recorded and generated inputs, and independently reviewed. Work is at an early stage: README reports 21 of 157,757 functions verified, and the game does not yet run on Paleblood’s own runtime.","description_zh":"将 Bloodborne PS4 可执行文件（CUSA03173，含 1.09 更新）的代码逐个函数改写为可读的 C++，目标是在项目以净室方式自行编写的运行时上实现原生 PC 源码移植。它追求功能等价而非字节一致：每个替换函数都以钩子接入，在录制与生成的输入上与原始机器码对照比较，再经独立审核。项目仍处早期：README 报告 157,757 个函数中已验证 21 个，游戏尚不能在 Paleblood 自己的运行时上运行。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"pikmin-2-matching-decomp-case","name":"Pikmin 2: a fully matched GameCube decompilation across five releases","name_zh":"《皮克敏2》：覆盖五个版本、已完全匹配的 GameCube 反编译","url":"https://github.com/projectPiki/pikmin2","evidence_url":"https://github.com/projectPiki/pikmin2/blob/ffbd853726427f2e90cd201aaca90dc82b34f990/README.MD","description_en":"A fan decompilation of Pikmin 2 that rebuilds main.dol for five GameCube releases (USA retail, two USA demos, PAL and Japan) with the original Metrowerks compilers, checking each against a stored SHA-1. The build reads main.dol from the user’s own copy of each release. decomp.dev reported all code matched and fully linked for every version at the reviewed commit, and a non-matching mode builds the US DOL entirely from C++ for modding.","description_zh":"由爱好者进行的《皮克敏2》反编译项目：用原版 Metrowerks 编译器为五个 GameCube 版本（美版零售版、两个美版体验版、PAL 版和日版）重建 main.dol，并逐一与仓库保存的 SHA-1 比对。构建读取使用者自有各版本中的 main.dol。decomp.dev 报告所审提交中各版本的代码均已全部匹配并完全链接；另有非一致性模式，可完全由 C++ 源码构建美版 DOL 以供模组制作。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"gran-turismo-4-matching-decomp-case","name":"Gran Turismo 4: an agent-assisted PS2 engine matching decompilation","name_zh":"Gran Turismo 4：借助智能体的 PS2 引擎匹配反编译","url":"https://github.com/gustavocanepa/gt4-decomp","evidence_url":"https://github.com/gustavocanepa/gt4-decomp/blob/e35ec1ddb6a5931252489ff7d8ed27520fdabe4e/README.md","description_en":"Decompiles Gran Turismo 4’s PS2 engine executable (CORE.GT4, NTSC-U v1.01) into one C or C++ source per function for Sony’s ee-gcc 2.96, matching public libraries such as newlib and Expat from their own source. The README credits AI agents (Anthropic’s Claude) driving the project’s tools with most of the matching, each function accepted only on a compiler-and-judge comparison, and reports 95.4% of functions and 83.6% of code bytes matched for an October 2026 commit. A local full build links sources at their original addresses, fills the rest from disassembly and compares SHA-1 with the user’s executable.","description_zh":"将 Gran Turismo 4（《GT 赛车 4》）的 PS2 引擎可执行文件（CORE.GT4，NTSC-U v1.01）按每个函数一个 C 或 C++ 源文件反编译，面向 Sony 的 ee-gcc 2.96，并用 newlib、Expat 等公开库自身的源码匹配其函数。README 称大部分匹配工作由驱动项目工具的 AI 智能体（Anthropic 的 Claude）完成，每个函数须通过编译器与判定器的比对才算完成，并报告 2026 年 10 月某次提交时 95.4% 的函数和 83.6% 的代码字节已匹配。本地完整构建将源码链接到原始地址，其余部分用反汇编补齐，再与使用者的可执行文件比较 SHA-1。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"mario-kart-wii-decomp-case","name":"Mario Kart Wii: an in-progress matching decompilation of the PAL release","name_zh":"《马力欧卡丁车 Wii》：进行中的 PAL 版一致性反编译","url":"https://github.com/snailspeed3/mkw","evidence_url":"https://github.com/snailspeed3/mkw/blob/78572c95c41dbf6cbb7dd251a567e538560ce1d8/README.md","description_en":"A work-in-progress matching decompilation of Mario Kart Wii that targets the PAL release (RMCP01), rebuilding main.dol and the StaticR.rel module from C and C++ with Metrowerks compilers and checking both against stored SHA-1 values. The build splits these binaries from a user-supplied disc image, and objdiff compares objects during development. The README’s progress badges point to a decomp.dev page that did not resolve at review, and the default branch was last updated in September 2025.","description_zh":"《马力欧卡丁车 Wii》的进行中一致性反编译，目标为 PAL 版（RMCP01）：用 Metrowerks 编译器从 C 与 C++ 源码重建 main.dol 和 StaticR.rel 模块，并与仓库保存的 SHA-1 比对。构建从使用者自备的光盘镜像中拆分这些二进制，开发时用 objdiff 比对目标文件。README 的进度徽章指向的 decomp.dev 页面在审阅时无法访问，默认分支最后更新于 2025 年 9 月。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"pinyon-shift-forza-horizon-recomp-case","name":"Pinyon Shift: a ShiftGlue static recompilation of Forza Horizon for PC","name_zh":"Pinyon Shift：以 ShiftGlue 将 Forza Horizon 静态重编译到 PC","url":"https://github.com/arcanite24/pinyon-shift","evidence_url":"https://github.com/arcanite24/pinyon-shift/blob/9331e453e9850d0fcc1c1606dee95db834a9d317/README.md","description_en":"Builds a native port of the Xbox 360 release of Forza Horizon by translating its PowerPC executable ahead of time into C++ with ShiftGlue, the author’s fork of ReXGlue, and compiling it on the player’s machine from their own disc. A renderer written for this game runs its GPU commands on Vulkan, and some translated library code, such as FMOD Ex DSP units, is replaced by independently written native code checked against the translated original. README presents it as a playable preview with rendering bugs and slowdowns.","description_zh":"使用作者对 ReXGlue 的分支 ShiftGlue，将 Xbox 360 版 Forza Horizon 的 PowerPC 可执行文件提前转换为 C++，并依玩家自有光盘在其电脑上编译，构建原生移植版。专为该游戏编写的渲染器在 Vulkan 上执行其 GPU 命令；部分转换后的库代码（如 FMOD Ex 的 DSP 单元）由独立编写、并与转换后原版对照检查的原生代码替代。README 称其为可游玩的预览版，仍有渲染错误和卡顿。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"th07-decomp-case","name":"Touhou 7: reconstructing Perfect Cherry Blossom 1.00b source","name_zh":"Touhou 7：重建东方妖妖梦 1.00b 版源码","url":"https://github.com/some100/th07","evidence_url":"https://github.com/some100/th07/blob/4878bf0e42a9280ef44735eb0517d4fda7cb6e04/README.md","description_en":"Reconstructs C++ source for the Windows executable of Touhou 7: Perfect Cherry Blossom 1.00b and its custom.exe configuration tool, built with the original Visual Studio .NET 2002 and DirectX 8 toolchain and compared function by function with the user’s originals through reccmp. The committed progress badges report th07.exe fully implemented at 99.78% accuracy and custom.exe fully matched. The README says the game should be fully playable, but a matching build trips the game’s integrity check, and the cross-platform ports live on separate branches.","description_zh":"为 Touhou 7：东方妖妖梦 1.00b 版的 Windows 可执行文件及其 custom.exe 设置工具重建 C++ 源码，使用原版 Visual Studio .NET 2002 与 DirectX 8 工具链构建，并通过 reccmp 与使用者自备的原程序逐函数比较。仓库内的进度徽章报告 th07.exe 已全部实现、准确率 99.78%，custom.exe 已完全匹配。README 称游戏应可完整游玩，但匹配构建会触发游戏自身的完整性检查；跨平台移植位于其他分支。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"dkc1-recomp-case","name":"DKC1Recomp: static recompilation of Donkey Kong Country","name_zh":"DKC1Recomp：《大金刚国度》的静态重编译","url":"https://github.com/elliotttate/DKC1Recomp","evidence_url":"https://github.com/elliotttate/DKC1Recomp/blob/3eb9a10c49cb210df2bd63addafe2a78cf9f4e22/README.md","description_en":"Statically recompiles the North American v1.0 SNES release of Donkey Kong Country into native Windows, macOS and iOS applications with a pinned fork of snesrecomp, which translates 65816 code to C and links it against a modelled SNES hardware runtime. Function boundaries, entry flag states and jump-table targets are ingested from a byte-identical community disassembly instead of discovered heuristically, and the game code is generated locally from the user’s verified ROM. Optional widescreen, CRT filters, MSU-1 music and a Dixie Kong Country variant are host-side additions to what the README calls a playable bring-up.","description_zh":"借助固定版本的 snesrecomp 分支，将 SNES 版《大金刚国度》北美 v1.0 静态重编译为 Windows、macOS 与 iOS 原生程序；该框架把 65816 代码转译为 C，并链接到模拟 SNES 硬件的运行时。函数边界、入口标志状态与跳转表目标均取自一份逐字节一致的社区反汇编，而非靠启发式发现；游戏代码在本地由使用者经校验的 ROM 生成。可选的宽屏、CRT 滤镜、MSU-1 音乐和 Dixie Kong Country 变体都是宿主端附加功能，README 称这一移植处于可游玩的初步运行阶段。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"san-andreas-unity-engine-case","name":"San Andreas Unity: a GTA San Andreas engine reimplementation in Unity","name_zh":"San Andreas Unity：在 Unity 中重新实现的《侠盗猎车手：圣安地列斯》引擎","url":"https://github.com/in0finite/SanAndreasUnity","evidence_url":"https://github.com/in0finite/SanAndreasUnity/blob/f685c437f48721afc0787f27d22c85d96e8684c7/README.md","description_en":"Reimplements the Grand Theft Auto: San Andreas engine in Unity (C#), loading the archives, RenderWare models and textures, collision, animations, audio, text and item definitions from the user’s own PC installation. README says it will not be a complete reimplementation; it focuses on gameplay features, multiplayer and a framework for extending and modding the game through C# plugins. Development has stalled: the newest commit on any branch dates from 2022-09-30.","description_zh":"在 Unity（C#）中重新实现《侠盗猎车手：圣安地列斯》的引擎，从使用者自有的 PC 版安装中读取归档、RenderWare 模型与纹理、碰撞、动画、音频、文本和物品定义。README 表示这不会是完整的重新实现，重点在于游戏玩法、多人模式，以及可通过 C# 插件扩展和改装游戏的框架。项目开发已停滞：所有分支中最新的提交日期为 2022-09-30。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"minecraft-lce-switch-decomp-case","name":"MinecraftLCE: an early-stage Minecraft: Nintendo Switch Edition decompilation","name_zh":"MinecraftLCE：处于早期阶段的 Minecraft: Nintendo Switch Edition 反编译","url":"https://github.com/GRAnimated/MinecraftLCE","evidence_url":"https://github.com/GRAnimated/MinecraftLCE/blob/959e1503b7b26d6821cfa98b3b05ef9089675195/README.md","description_en":"Decompiles Minecraft: Nintendo Switch Edition v1.0.17, a Legacy Console Edition release, into C++ that is compared function by function with the original executable using a patched Clang 4.0.1 and the open-ead Switch decompilation tools. The README explains the choice of the Switch build for its matchable Clang toolchain and type information, with names ported from the symbol-bearing Wii U Edition. At the reviewed commit the function list marks about 11% of functions decompiled, most of them matching; the result cannot run the game.","description_zh":"将 Legacy Console Edition 系列中的 Minecraft: Nintendo Switch Edition v1.0.17 反编译为 C++，借助打过补丁的 Clang 4.0.1 和 open-ead 的 Switch 反编译工具，与原可执行文件逐函数比较。README 解释了选用 Switch 版的原因：其 Clang 工具链可以匹配且带有类型信息，函数名则从带符号的 Wii U Edition 移植而来。所审提交时函数列表标记约 11% 的函数已反编译，其中大多已匹配；产物无法运行游戏。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"ff7-ps1-matching-decomp-case","name":"Final Fantasy VII: a matching PlayStation decompilation","name_zh":"Final Fantasy VII：PlayStation 版一致性反编译","url":"https://github.com/Xeeynamo/ff7-decomp","evidence_url":"https://github.com/Xeeynamo/ff7-decomp/blob/37f35a536ba80f0575e79e243a273b28702d494d/README.md","description_en":"Reconstructs C source for the US PlayStation release of Final Fantasy VII, aiming for code that compiles back to the original main executable and its game overlays. The build splits the user’s disc files with splat, compiles with period cc1-psx compilers and checks every rebuilt file against its SHA-1. A native build against the PsyZ PlayStation-library replacement is compiled in CI but is not documented as a playable port.","description_zh":"为 Final Fantasy VII 美版 PlayStation 发行版重建 C 源码，目标是让代码重新编译出原版主可执行文件及各游戏覆盖段（overlay）。构建流程用 splat 拆分使用者自备的光盘文件，以当年的 cc1-psx 编译器编译，并用 SHA-1 校验每个重建文件。基于 PsyZ（PlayStation 库替代实现）的原生构建会在 CI 中编译，但未作为可游玩的移植版加以说明。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"megaman-x-snes-recomp-case","name":"Mega Man X Recompiled: a snesrecomp static recompilation","name_zh":"Mega Man X Recompiled：基于 snesrecomp 的静态重编译","url":"https://github.com/mstan/MegaManXSNESRecomp","evidence_url":"https://github.com/mstan/MegaManXSNESRecomp/blob/adc1fea7baf90614a4272a90336cfcea563c504c/README.md","description_en":"Statically translates the 65816 CPU code of the SNES Mega Man X (USA Rev 1) to C with the snesrecomp framework; the PPU, audio, DMA and other hardware run in the framework’s runtime, and a LakeSnes-derived interpreter executes whatever the static pass cannot prove. The C is generated locally from the user’s ROM, with function names imported from community DiztinGUIsh annotations. Playable Zero, co-op and rollback netplay, X2/X3 boss weapons and adaptive widescreen are layered on top, using assets extracted locally from the user’s own sequel ROMs.","description_zh":"借助 snesrecomp 框架，将 SNES 版《洛克人 X》（美版 Rev 1）的 65816 CPU 代码静态转译为 C；PPU、音频、DMA 等硬件由框架运行时处理，静态分析无法证明的部分则交给源自 LakeSnes 的解释器执行。C 代码在本地由使用者的 ROM 生成，函数名取自社区的 DiztinGUIsh 注解。项目在此基础上加入可操作的 Zero、合作与回滚联机、X2／X3 的头目武器以及自适应宽屏，所用素材在本地从使用者自有的续作 ROM 中提取。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"opensc4-simcity-4-reimplementation-case","name":"OpenSC4: an early open-source reimplementation of SimCity 4","name_zh":"OpenSC4：SimCity 4 的早期开源重新实现","url":"https://github.com/OpenSC4-org/OpenSC4","evidence_url":"https://github.com/OpenSC4-org/OpenSC4/blob/fdc90c33e6e012b8c825f20ee10c51f55796df39/README.md","description_en":"Reimplements SimCity 4 as a Godot project in GDScript that reads DBPF archives, region folders and city saves from the user’s own SimCity 4 installation. The code draws a region view with city thumbnails and interface elements built from the game’s UI definitions, opens a saved city’s terrain and water in 3D, and includes a DAT explorer for previewing archive subfiles. It is an early, inactive engine case without simulation gameplay, not a playable replacement.","description_zh":"以 Godot 项目和 GDScript 重新实现 SimCity 4，从使用者自有的 SimCity 4 安装目录读取 DBPF 归档、区域文件夹和城市存档。代码可绘制带城市缩略图的区域视图，并依据游戏的 UI 定义生成界面元素，可在 3D 中打开已存城市的地形与水面，还附带用于预览归档子文件的 DAT 浏览器。这是一个早期且已停滞的引擎案例，尚无模拟玩法，并非可替代原版的实现。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"synchrony","name":"synchrony","name_zh":"synchrony JavaScript 反混淆工具","url":"https://github.com/relative/synchrony","evidence_url":"https://github.com/relative/synchrony/blob/710e9f6c21ceea0cddf178eb863ef678f5d9d6ee/README.md","description_en":"JavaScript cleaner and deobfuscator aimed mainly at output from javascript-obfuscator (obfuscator.io). It parses a script with acorn and runs a fixed pipeline of AST transformers that fold expressions, clean member accesses, remove dead branches, split sequence expressions, undo switch-based control-flow flattening and decode string arrays, re-implementing their base64 and RC4 decoders in TypeScript rather than executing the input. It ships on npm as deobfuscator with a synchrony CLI and a library API, and optional renaming replaces identifiers with generated word names rather than recovering the originals.","description_zh":"主要面向 javascript-obfuscator（obfuscator.io）输出的 JavaScript 清理与反混淆工具。它用 acorn 解析脚本，再运行一组固定的 AST 转换器：折叠表达式、整理成员访问、删除死分支、拆分逗号表达式、还原基于 switch 的控制流平坦化，并解码字符串数组；其中 base64 和 RC4 解码器以 TypeScript 重新实现，而不是执行输入代码。它以 deobfuscator 之名发布在 npm 上，提供 synchrony 命令行工具和库 API；可选的重命名会把标识符换成生成的单词名，并不能恢复原名。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"relive-oddworld-abe-engine-case","name":"R.E.L.I.V.E.: an Oddworld Abe’s Oddysee and Abe’s Exoddus engine reimplementation","name_zh":"R.E.L.I.V.E.：Oddworld: Abe’s Oddysee 与 Abe’s Exoddus 引擎的重新实现","url":"https://github.com/AliveTeam/alive_reversing","evidence_url":"https://github.com/AliveTeam/alive_reversing/blob/3be8967b71b29e6e61009d291bd64dce39abf7ac/README.md","description_en":"Reimplements the engine of Oddworld: Abe’s Oddysee and Abe’s Exoddus as an open-source replacement executable that runs from the user’s own game folder. The team decompiled the original executables and replaced their functions incrementally, using injected DLLs that hook reimplemented code into the patched retail executable, then rewrote the result into a standalone cross-platform engine. The project site says both games are playable in their entirety, with bug fixes and windowed, high-resolution and controller play.","description_zh":"以开源的替代可执行文件重新实现 Oddworld: Abe’s Oddysee 与 Abe’s Exoddus 的引擎，在使用者自己的游戏目录中运行。团队先反编译原版可执行文件并逐步替换其中的函数，借助注入的 DLL 将重新实现的代码挂接到打过补丁的零售版程序中，之后再把成果改写为独立的跨平台引擎。项目网站称两款游戏均可完整通关，并修复了缺陷，支持窗口模式、高分辨率和手柄游玩。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"retdec","name":"RetDec","name_zh":"RetDec 可重定向机器码反编译器","url":"https://github.com/avast/retdec","evidence_url":"https://github.com/avast/retdec/blob/9450585772e6f1c18e5f0b2ad5518a18d6bce71e/README.md","description_en":"Avast's retargetable machine-code decompiler built on LLVM. It takes ELF, PE, Mach-O, COFF, AR, Intel HEX or raw code for 32-bit x86, ARM, MIPS, PIC32 and PowerPC or 64-bit x86-64 and ARM64, recovers functions, types and C++ class hierarchies, and emits C or a Python-like language with call and control-flow graphs.","description_zh":"Avast 推出的基于 LLVM 的可重定向机器码反编译器。可处理 ELF、PE、Mach-O、COFF、AR、Intel HEX 或原始机器码，覆盖 32 位 x86、ARM、MIPS、PIC32、PowerPC 以及 64 位 x86-64 和 ARM64，能恢复函数、类型和 C++ 类层次结构，输出 C 或类 Python 语言代码，并生成调用图和控制流图。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"aoe-free-software-remake-case","name":"Age of Empires Free Software Remake: a re-implementation on the original data","name_zh":"Age of Empires Free Software Remake：基于原版数据的重新实现","url":"https://github.com/FolkertVanVerseveld/aoe","evidence_url":"https://github.com/FolkertVanVerseveld/aoe/blob/3234eac7098124e7fac11272697cacb3aed5e608/README.md","description_en":"Re-implements Microsoft’s Age of Empires and its Rise of Rome expansion as a cross-platform C++17 engine on SDL2 and OpenGL that loads the original game’s DRS archives and language.dll resources. README says it mimics the Windows API and the Genie engine for compatibility and reconstructs some code from the disassembly; the repository adds format notes and Python tools for inspecting the original data files. Only very basic gameplay through a multiplayer session exists so far, so it is an early engine case rather than a playable replacement.","description_zh":"以基于 SDL2 和 OpenGL 的跨平台 C++17 引擎重新实现 Microsoft 的《帝国时代》及其资料片《罗马复兴》，载入原版游戏的 DRS 归档和 language.dll 资源。README 称项目为兼容起见模仿 Windows API 和 Genie 引擎，部分代码依据反汇编重建；仓库另附格式笔记和用于检查原版数据文件的 Python 工具。目前只能通过多人会话进行非常基础的游戏，因此这是一个早期引擎案例，而非可替代原版游玩的实现。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"god-of-war-ps2-recomp-case","name":"God of War PS2 static recompilation: a native Windows port via PS2Recomp","name_zh":"《战神》PS2 静态重编译：基于 PS2Recomp 的 Windows 原生移植","url":"https://github.com/KIexster/god-of-war-recomp","evidence_url":"https://github.com/KIexster/god-of-war-recomp/blob/92ece581c673842c282a9c23819545de5ab92d3c/README.md","description_en":"Statically recompiles the MIPS R5900 code of the NTSC-U PlayStation 2 God of War executable (SCUS-97399) to C++ with PS2Recomp and builds it as a native Windows program. Since October 2026 the port builds on Waffle565’s runtime, which replaces the PS2 hardware with native code: VU1 microprograms and, optionally, the game’s IRX modules are compiled ahead of time, and an OpenGL renderer stands in for the GS. The repository holds only the game-specific function map, recompiler configuration, overrides and runtime patches; the README reports gameplay on the opening ship level, with sustained 60 fps and a full playthrough still pending.","description_zh":"使用 PS2Recomp 将 PlayStation 2 版《战神》美版（SCUS-97399）可执行文件中的 MIPS R5900 代码静态重编译为 C++，并构建为 Windows 原生程序。自 2026 年 10 月起，移植以 Waffle565 的运行时为基础，用原生代码取代 PS2 硬件：VU1 微程序以及可选的游戏 IRX 模块会预先编译，OpenGL 渲染器则代替 GS。仓库只包含本作专用的函数映射、重编译器配置、覆盖实现与运行时补丁；README 报告已能在开场的船上关卡中游玩，而稳定 60 fps 与完整通关仍待完成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"redasm","name":"REDasm","name_zh":"REDasm 反汇编器","url":"https://github.com/redasm-dev/redasm","evidence_url":"https://github.com/redasm-dev/redasm/blob/509b76548a741aac569161df666b6c13f927d6f5/README.md","description_en":"Cross-platform interactive disassembler whose version 4 is a plain-C rewrite: a C17 engine library, the Qt6 GUI kept in this repository, and loader, processor and analyzer plugins loaded as shared libraries. The listing supports renaming, comments and typed data, with a synchronized control-flow graph, cross-references, string detection, a hex view, patching and saved projects. Besides PE and ELF, loaders cover retro and console formats such as DOS MZ, Win16 NE, OS/2 LE/LX, PlayStation 1, original Xbox and ZX Spectrum, with x86/x86-64, MIPS32, ARM/Thumb, ARM64, Z80 and 6502 processors.","description_zh":"跨平台交互式反汇编器，第 4 版以纯 C 重写：由 C17 引擎库、保留在本仓库中的 Qt6 图形界面，以及以共享库形式加载的加载器、处理器和分析器插件组成。反汇编列表支持重命名、注释和类型化数据，并提供同步的控制流图、交叉引用、字符串检测、十六进制视图、补丁和项目保存。除 PE 和 ELF 外，加载器还支持 DOS MZ、Win16 NE、OS/2 LE/LX、PlayStation 1、初代 Xbox 和 ZX Spectrum 等复古及主机格式，处理器涵盖 x86/x86-64、MIPS32、ARM/Thumb、ARM64、Z80 和 6502。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"protobuf-inspector","name":"protobuf-inspector","name_zh":"protobuf-inspector 未知定义 Protobuf 解析工具","url":"https://github.com/mildsunrise/protobuf-inspector","evidence_url":"https://github.com/mildsunrise/protobuf-inspector/blob/3211be9c2fb1d24e788ff492571cd0ba895c519a/README.md","description_en":"Parses Protocol Buffers blobs (proto2 or proto3) without their .proto definition and prints a colored view of the fields in wire order, trying each length-delimited chunk as a nested message, then a packed array, a string and finally a hexdump. Analysts record what they work out in a protobuf_config.py file, with field types and names, message and enum types and custom native types, until the parser no longer has to guess. Field names, zig-zag encoding, signedness and integer-versus-float choices cannot be read from the wire, and the README says guesses can be wrong, especially for small chunks.","description_zh":"无需对应的 .proto 定义即可解析 Protocol Buffers 数据块（proto2 或 proto3），按线路编码顺序以彩色输出字段；对每个长度限定的数据块，依次尝试解析为嵌套消息、打包数组、字符串，最后退回十六进制转储。分析者把推断出的内容写入 protobuf_config.py，包括字段类型与名称、消息和枚举类型以及自定义原生类型，直到解析器不再需要猜测。字段名、zig-zag 编码、有无符号以及整数还是浮点数，都无法从线路数据中读出；README 也说明猜测可能出错，小数据块尤甚。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"lighthouse","name":"Lighthouse","name_zh":"Lighthouse 代码覆盖率浏览插件","url":"https://github.com/gaasedelen/lighthouse","evidence_url":"https://github.com/gaasedelen/lighthouse/blob/562595be9bd99e8a5dfef6017d608467f5706630/README.md","description_en":"Code-coverage explorer plugin for IDA Pro and Binary Ninja that loads execution traces of native programs and paints the executed code across the disassembler's views, without needing symbols or source. Its coverage overview lists per-function coverage, and a composing shell combines loaded coverage sets with logical operators to diff runs, filter functions and jump to addresses, while coverage cross-references show which of many batch-loaded sets executed a block. It reads DynamoRIO drcov logs, module+offset, absolute-address and Tenet traces, writes basic HTML coverage reports, and ships a prototype Intel Pin tool and a Frida script that produce drcov-compatible logs.","description_zh":"面向 IDA Pro 和 Binary Ninja 的代码覆盖率浏览插件，载入原生程序的执行轨迹，并在反汇编器的各个视图中为已执行代码着色，无需符号或源码。覆盖率总览按函数列出覆盖情况；组合命令行可用逻辑运算符组合已载入的覆盖率集合，用于比较多次运行的差异、筛选函数或跳转到指定地址；覆盖率交叉引用则显示批量载入的众多集合中哪些执行过某个基本块。它可读取 DynamoRIO drcov 日志、模块+偏移、绝对地址和 Tenet 轨迹，能生成简单的 HTML 覆盖率报告，并附带可输出 drcov 兼容日志的原型 Intel Pin 工具和 Frida 脚本。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"racewave46-wave-race-64-recomp-case","name":"RaceWave46: an AI-assisted Wave Race 64 recompilation for Windows","name_zh":"RaceWave46：AI 辅助的《Wave Race 64》Windows 重编译","url":"https://github.com/DomazinUS/RaceWave46","evidence_url":"https://github.com/DomazinUS/RaceWave46/blob/5c34f3711426978107707a8f06af9c2af4ee5401/README.md","description_en":"Recompiles the USA Rev 1 Nintendo 64 release of Wave Race 64 into a native Windows application with N64Recomp and RSPRecomp, on modified copies of the N64ModernRuntime, RecompFrontend and RT64 stacks. Game and microcode C is generated locally from the user’s ROM, after an included widescreen patch is applied to a temporary copy, and checked against recorded checksums. The port adds higher resolutions, frame interpolation, ultrawide views, rasterized and ray-traced reflections and shadows, split-screen or separate-window two-player play and RetroAchievements; the maintainer calls it an AI-assisted recompilation.","description_zh":"使用 N64Recomp 与 RSPRecomp，在经修改的 N64ModernRuntime、RecompFrontend 和 RT64 之上，将 Nintendo 64 版《Wave Race 64》美版 Rev 1 重编译为 Windows 原生程序。游戏与微码的 C 代码在本地由使用者的 ROM 生成：先将随附的宽屏补丁应用到临时副本，再按记录的校验和核对生成结果。移植加入了更高分辨率、帧插值、超宽视野、光栅化与光线追踪的反射和阴影、分屏或分窗口的双人游戏以及 RetroAchievements；维护者称其为 AI 辅助的重编译。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"opendrop-airdrop-reimplementation-case","name":"OpenDrop: an open reimplementation of Apple AirDrop","name_zh":"OpenDrop：Apple AirDrop 的开源重新实现","url":"https://github.com/seemoo-lab/opendrop","evidence_url":"https://github.com/seemoo-lab/opendrop/blob/11fe7ba7861093b302bc0637e8cb10adf2d29337/README.md","description_en":"Python command-line reimplementation of Apple's AirDrop protocol from SEEMOO Lab's reverse-engineering research. It finds receivers via _airdrop._tcp DNS-SD, sends binary-plist /Discover and /Ask requests over HTTPS and uploads gzip-compressed CPIO archives to exchange files with iOS and macOS. It is not affiliated with Apple.","description_zh":"基于 SEEMOO 实验室逆向研究、用 Python 编写的 Apple AirDrop 协议命令行重新实现。它通过 _airdrop._tcp DNS-SD 发现接收方，经 HTTPS 发送二进制 plist 格式的 /Discover 和 /Ask 请求，并上传 gzip 压缩的 CPIO 归档，与 iOS 和 macOS 设备互传文件。它与 Apple 无关联。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"chipsec","name":"CHIPSEC","name_zh":"CHIPSEC 平台安全评估框架","url":"https://github.com/chipsec/chipsec","evidence_url":"https://github.com/chipsec/chipsec/blob/c11756375417cc859e25a98e0788849ebd6eb8cc/README.md","description_en":"Platform security assessment framework, with Intel Corporation copyright notices, for analyzing PC hardware configuration, BIOS/UEFI system firmware and platform components from Windows, Linux or the UEFI shell. chipsec_main runs check modules that report whether expected protections are in place, such as BIOS and SPI flash write protection and locks, SMM and SMRR protection, memory-map locks and Secure Boot variables, as PASSED, FAILED, WARNING or informational results with JSON, XML and Markdown output. chipsec_util gives command-line and Python access to low-level interfaces and firmware data, including dumping the SPI flash to an image, decoding flash images into firmware volumes, files and NVRAM variables, and listing UEFI variables and tables.","description_zh":"平台安全评估框架（源码带有 Intel Corporation 版权声明），可在 Windows、Linux 或 UEFI Shell 中分析 PC 硬件配置、BIOS/UEFI 系统固件及平台组件。chipsec_main 运行检查模块，报告预期的保护措施是否到位，例如 BIOS 与 SPI 闪存的写保护和锁定、SMM 与 SMRR 保护、内存映射锁定及安全启动变量，结果分为 PASSED、FAILED、WARNING 和信息类，并可输出 JSON、XML 和 Markdown。chipsec_util 通过命令行和 Python 访问底层接口和固件数据，包括将 SPI 闪存转储为镜像、把闪存镜像解析为固件卷、文件和 NVRAM 变量，以及列出 UEFI 变量和表。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"apk-studio","name":"APK Studio","name_zh":"APK Studio Android 逆向 IDE","url":"https://github.com/vaibhavpandeyvpz/apkstudio","evidence_url":"https://github.com/vaibhavpandeyvpz/apkstudio/blob/c6e2724786f6e25323d20db1c1ceb2160fbc1ee9/README.md","description_en":"Qt6 desktop front end that drives Apktool, JADX, uber-apk-signer and ADB from an IDE-style workspace for Android packages. It decodes an APK into smali and resources, optionally adds JADX Java output, then rebuilds, signs (with optional keystore generation and zipalign) and installs the result on a selected device; manufacturer framework files and extra Apktool arguments can be supplied. Decoded projects open in a file tree with syntax-highlighted smali, Java, XML and YAML editing, an image viewer, a hex editor and search across files.","description_zh":"基于 Qt6 的桌面前端，在 IDE 式工作区中调用 Apktool、JADX、uber-apk-signer 和 ADB 处理 Android 安装包。它将 APK 解码为 smali 和资源文件，可选附加 JADX 生成的 Java 代码，随后重新打包、签名（可生成密钥库并执行 zipalign）并安装到所选设备；还可指定厂商框架文件和额外的 Apktool 参数。解码后的项目以文件树形式打开，提供 smali、Java、XML 和 YAML 的语法高亮编辑、图片查看器、十六进制编辑器和跨文件搜索。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"valetudo-robot-cloud-replacement-case","name":"Valetudo: local replacement for robot-vacuum vendor clouds","name_zh":"Valetudo：扫地机器人厂商云的本地替代","url":"https://github.com/Hypfer/Valetudo","evidence_url":"https://github.com/Hypfer/Valetudo/blob/78267517d3036258322b6760ba8a9979d197e249/README.md","description_en":"Replaces the vendor cloud of supported robot vacuums with a local service that runs on the rooted robot beside the vendor firmware and emulates the cloud endpoints that firmware expects, including a miio dummycloud and a counterpart for Midea's MSmart protocol. Its FAQ says each new vendor backend meant reverse engineering data formats, authentication and communication without vendor documentation; Valetudo converts the proprietary map formats into one ValetudoMap format and keeps Kaitai Struct descriptions of Dreame, Roborock and Viomi map files and a Midea protobuf schema as references. It adds a web interface, a REST API with Swagger UI and MQTT/Home Assistant integration, while feature parity with the vendor apps is an explicit non-goal.","description_zh":"用运行在已 root 机器人上、与厂商固件并存的本地服务取代受支持扫地机器人的厂商云，并模拟固件所期待的云端接口，包括 miio 模拟云（dummycloud）以及对应 Midea MSmart 协议的实现。其 FAQ 说明，每支持一个新厂商，都需要在没有厂商文档的情况下逆向分析数据格式、认证和通信；Valetudo 将各家专有地图格式转换为统一的 ValetudoMap 格式，并保留 Dreame、Roborock、Viomi 地图文件的 Kaitai Struct 描述和一份 Midea protobuf 模式作为参考。它提供网页界面、带 Swagger UI 的 REST API 以及 MQTT／Home Assistant 集成，但明确不以与厂商应用功能对等为目标。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","protocol"],"verified_at":"2026-10-19"},{"id":"sourcemapper","name":"sourcemapper","name_zh":"sourcemapper 源映射源码还原工具","url":"https://github.com/denandz/sourcemapper","evidence_url":"https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/README.md","description_en":"Go command-line tool that recreates a web front end's original JavaScript source tree from a source map generated by webpack or a similar bundler, writing each embedded source file under the path the map records. It takes a .map file by URL or local path, walks a directory of .map files, or fetches a JavaScript file and follows its sourceMappingURL comment or SourceMap response header, including inline data: maps.","description_zh":"Go 编写的命令行工具，可根据 webpack 等打包工具生成的源映射（source map）重建网站前端原有的 JavaScript 源码目录树，并把映射中内嵌的每个源文件写到其记录的路径下。它可通过 URL 或本地路径读取 .map 文件，递归处理整个目录中的 .map 文件，也可抓取 JavaScript 文件并跟随其中的 sourceMappingURL 注释或 SourceMap 响应头，内联的 data: 映射同样支持。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"jazz2-resurrection-engine-case","name":"Jazz² Resurrection: a native C++ reimplementation of Jazz Jackrabbit 2","name_zh":"Jazz² Resurrection：《爵士兔 2》的原生 C++ 重新实现","url":"https://github.com/deathkiller/jazz2-native","evidence_url":"https://github.com/deathkiller/jazz2-native/blob/c18381c246271d76c70af723a8ab5615028e3c6c/README.md","description_en":"Reimplements Jazz Jackrabbit 2 (1998) as a native C++ game on an extensively modified nCine engine, converting the user’s original game files into its own cache on first start. It runs on desktop, mobile, web and many homebrew console targets, with multiplayer, an enhanced Reforged mode and partial JJ2+ and MLLE support. A two-sided trajectory probe checks its non-Reforged movement against the original game, and the project reports 376 of 406 scenarios within 25 px/s.","description_zh":"以原生 C++ 在深度修改的 nCine 引擎上重新实现《爵士兔 2》（Jazz Jackrabbit 2，1998），首次启动时把使用者的原版游戏文件转换为自己的缓存。它可在桌面、移动设备、网页和众多自制软件主机平台上运行，支持多人游戏、增强的 Reforged 模式，并部分支持 JJ2+ 与 MLLE。项目用一个双向轨迹探针把非 Reforged 模式的移动与原版游戏对照，报告 406 个场景中有 376 个误差在 25 px/s 以内。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"binabsinspector","name":"BinAbsInspector","name_zh":"BinAbsInspector 二进制漏洞静态扫描工具","url":"https://github.com/KeenSecurityLab/BinAbsInspector","evidence_url":"https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/README.md","description_en":"Static vulnerability scanner from Tencent Keen Lab that runs as a Ghidra extension or headless script and applies abstract interpretation to Ghidra's P-code rather than to assembly, covering x86, x64, ARMv7 and AArch64 binaries. Its flow- and context-sensitive interprocedural analysis, with configurable value-set size and call-string depth, optional Z3 constraint solving and models of external functions, feeds checkers for 13 CWE classes, including command injection, buffer overflows and out-of-bounds access, format strings, integer overflow, double free, use-after-free and NULL dereference. Warnings list the instruction address and its call context, in the Ghidra console or as JSON.","description_zh":"腾讯科恩实验室开发的二进制静态漏洞扫描工具，以 Ghidra 扩展或无界面脚本方式运行，在 Ghidra 的 P-code 而非汇编上进行抽象解释，支持 x86、x64、ARMv7 和 AArch64 二进制。它执行流敏感、上下文敏感的过程间分析，可配置值集合大小和调用串深度，可选用 Z3 约束求解，并对外部函数建模，在此基础上运行 13 类 CWE 检查，涵盖命令注入、缓冲区溢出与越界访问、格式化字符串、整数溢出、重复释放、释放后使用和空指针解引用等。告警会列出指令地址及其调用上下文，显示在 Ghidra 控制台中或以 JSON 输出。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"libimobiledevice","name":"libimobiledevice","name_zh":"libimobiledevice iOS 设备协议库","url":"https://github.com/libimobiledevice/libimobiledevice","evidence_url":"https://github.com/libimobiledevice/libimobiledevice/blob/fa0f79190142bc309307967c058f89c1b36eb6b8/README.md","description_en":"C library and command-line tools that speak iOS devices' native service protocols without Apple's proprietary libraries or a jailbreak. Over usbmuxd or Wi-Fi sync it implements lockdownd pairing and services such as AFC file access, backup, app installation, crash reports, syslog, debugserver and WebKit inspection, plus Cython bindings.","description_zh":"用 C 编写的库及命令行工具，无需 Apple 的专有库或越狱即可使用 iOS 设备的原生服务协议通信。它经 usbmuxd 或 Wi-Fi 同步连接，实现 lockdownd 配对，以及 AFC 文件访问、备份、应用安装、崩溃报告、系统日志、debugserver 和 WebKit 检查等服务，并提供 Cython 绑定。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"ngrev","name":"ngrev","name_zh":"ngrev Angular 应用结构分析工具","url":"https://github.com/mgechev/ngrev","evidence_url":"https://github.com/mgechev/ngrev/blob/edd1ee316a7f2a0d9ddbf94ae91bb0b624997edb/README.md","description_en":"Electron desktop application that statically analyzes an Angular project's TypeScript sources and draws interactive graphs of its NgModules, components, directives, pipes and providers and how they depend on each other, without running the application. A project is loaded through its tsconfig file; views move from the module tree to individual modules, templates and providers, with fuzzy symbol search and PNG export of the current graph.","description_zh":"一款 Electron 桌面应用，对 Angular 项目的 TypeScript 源码做静态分析，以交互式图形展示其中的 NgModule、组件、指令、管道和服务提供者及其依赖关系，无需运行该应用。通过项目的 tsconfig 文件载入后，可从模块树逐层查看单个模块、模板和提供者，支持符号模糊搜索，并可将当前图形导出为 PNG。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"apkid","name":"APKiD","name_zh":"APKiD Android 加壳与混淆识别工具","url":"https://github.com/rednaga/APKiD","evidence_url":"https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/README.md","description_en":"PEiD-style identifier for Android packages from RedNaga. It scans APK and DEX files, nested ZIP entries and the native ELF libraries, PE DLLs and resources inside them with YARA rules, using the yara-python-dex DEX module, and reports the compilers, packers, protectors, obfuscators and anti-VM or anti-disassembly tricks it recognizes, per file or as JSON. Optional tracker rules attributed to the Exodus API flag embedded tracking SDKs; APKiD only identifies, and does not unpack or deobfuscate anything.","description_zh":"RedNaga 推出的 Android 安装包识别工具，类似 PEiD。它借助 yara-python-dex 的 DEX 模块，用 YARA 规则扫描 APK、DEX 文件、嵌套的 ZIP 条目及其中的原生 ELF 库、PE 格式 DLL 和资源，报告识别出的编译器、加壳工具、保护工具、混淆工具以及反虚拟机或反反汇编手法，可按文件输出或输出 JSON。可选的追踪器规则注明来自 Exodus API，用于标出内嵌的追踪 SDK；APKiD 只做识别，不会脱壳或反混淆。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"jsluice","name":"jsluice","name_zh":"jsluice JavaScript 静态提取工具","url":"https://github.com/BishopFox/jsluice","evidence_url":"https://github.com/BishopFox/jsluice/blob/0ddfab153e060a9eeaded4d8669233f7c071e7e4/README.mkd","description_en":"Bishop Fox's Go library and command-line tool that parses JavaScript with tree-sitter to recover the endpoints a script calls, judging values by how the code uses them rather than by regular expressions alone. URL extraction follows location assignments, window.open, fetch, XMLHttpRequest and jQuery request calls, keeps the HTTP method, headers and query or body parameters, and stands in a placeholder for values only known at run time. Other modes flag credential-shaped values, print syntax trees, run tree-sitter queries and reformat minified code.","description_zh":"Bishop Fox 推出的 Go 库与命令行工具，借助 tree-sitter 解析 JavaScript，还原脚本所调用的接口地址；它依据代码如何使用某个值来判断，而不仅仅依靠正则表达式。URL 提取会跟踪 location 赋值、window.open、fetch、XMLHttpRequest 和 jQuery 请求调用，保留 HTTP 方法、请求头以及查询或请求体参数，并以占位符代替只有运行时才能确定的值。其他模式可标记形似凭据的值、打印语法树、运行 tree-sitter 查询以及格式化压缩代码。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"lba2remake-little-big-adventure-case","name":"LBA2 Remake: a Little Big Adventure 1 and 2 reimplementation in TypeScript and Three.js","name_zh":"LBA2 Remake：以 TypeScript 和 Three.js 重新实现 Little Big Adventure 1 与 2","url":"https://github.com/LBALab/lba2remake","evidence_url":"https://github.com/LBALab/lba2remake/blob/db54f5de071354939a8b02e71e47c53343ab6ee5/README.md","description_en":"Reimplements the engine of Little Big Adventure 2, and now also Little Big Adventure 1, in TypeScript, Three.js and React so that it runs in a browser on resources imported from the user’s copy of the game. README calls it a full re-engineering rather than a disassembly-based approach: every island and building can be explored and most graphics and part of the gameplay work, but the game cannot yet be completed. It adds an editor with an actor-script debugger, VR support and fan-made 3D replacement models for the isometric scenes.","description_zh":"用 TypeScript、Three.js 和 React 重新实现 Little Big Adventure 2 的引擎，现在也涵盖 Little Big Adventure 1，在浏览器中运行，资源从使用者自有的游戏中导入。README 称这是完全重新设计实现，而非基于反汇编的方法：所有岛屿和建筑都可以探索，大部分图形和部分玩法已经可用，但游戏目前还无法通关。项目另外提供带角色脚本调试器的编辑器、VR 支持，以及由爱好者为等距场景制作的 3D 替换模型。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"vulhunt","name":"VulHunt Community Edition","name_zh":"VulHunt 社区版漏洞挖掘框架","url":"https://github.com/vulhunt-re/vulhunt","evidence_url":"https://github.com/vulhunt-re/vulhunt/blob/b2fa617923f47d84a57899137107380391700b64/README.md","description_en":"Open-source Community Edition of Binarly REsearch's VulHunt engine for hunting vulnerabilities in POSIX binaries and UEFI firmware on x86 and ARM. Lua rules run on the Rust BIAS framework, which lifts code to Ghidra's P-code and bundles Ghidra's C++ decompiler, and combine taint and dataflow tracking, Weggli-based queries over decompiled code, byte patterns, FLIRT signatures and type libraries; findings are written as JSON with annotated decompiled code. The CLI scans single binaries, Binarly BA2 archives or Binary Ninja databases, and can also run as an MCP server that lets AI assistants open a project, query it with Lua, rename functions and keep notes.","description_zh":"Binarly REsearch 团队 VulHunt 引擎的开源社区版，用于在 x86 和 ARM 架构的 POSIX 二进制和 UEFI 固件中挖掘漏洞。Lua 规则运行在 Rust 编写的 BIAS 框架之上（该框架将代码提升为 Ghidra P-code，并内置 Ghidra 的 C++ 反编译器），可结合污点与数据流追踪、基于 Weggli 的反编译代码查询、字节模式、FLIRT 签名和类型库进行检测；结果以 JSON 输出，并附带标注后的反编译代码。命令行可扫描单个二进制、Binarly BA2 归档或 Binary Ninja 数据库，也可作为 MCP 服务器运行，让 AI 助手打开项目、用 Lua 查询、重命名函数并记录注释。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"sniffle","name":"Sniffle","name_zh":"Sniffle 蓝牙低功耗嗅探器","url":"https://github.com/nccgroup/Sniffle","evidence_url":"https://github.com/nccgroup/Sniffle/blob/3a53f5ab21df7599ad0c46475d322603c1a54bb7/README.md","description_en":"NCC Group's sniffer for Bluetooth 5 and 4.x Low Energy, made of firmware for TI CC1352/CC26x2 radio boards and Python host tools. It captures advertising and connection traffic on the 1M, 2M and coded PHYs, follows connections through channel-map, connection-parameter and PHY changes, captures BT5 extended advertising, and filters by MAC address, IRK, RSSI or advertisement content; for a filtered target it hops all three primary advertising channels, which the README says makes connection detection nearly three times more reliable than single-channel sniffers. Captures are saved as Ubertooth-compatible PCAP, a Wireshark extcap plugin starts captures from the Wireshark GUI, and command-line decoders print advertising data, including Apple and Microsoft manufacturer-specific fields.","description_zh":"NCC Group 推出的蓝牙 5 与 4.x 低功耗（BLE）嗅探器，由运行在 TI CC1352/CC26x2 射频板上的固件和 Python 主机工具组成。它可在 1M、2M 和编码 PHY 上捕获广播与连接流量，跟随连接经历的信道映射、连接参数和 PHY 变更，捕获 BT5 扩展广播，并按 MAC 地址、IRK、RSSI 或广播内容过滤；对已过滤的目标会在全部三个主广播信道间跳频，README 称这使连接检测的可靠性比只监听单一信道的嗅探器高出近三倍。捕获结果保存为与 Ubertooth 兼容的 PCAP；Wireshark extcap 插件可直接从 Wireshark 界面启动捕获，命令行解码器可打印广播数据，包括 Apple 和 Microsoft 的厂商自定义字段。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"dex2jar","name":"dex2jar","name_zh":"dex2jar Android DEX 转换工具集","url":"https://github.com/pxb1988/dex2jar","evidence_url":"https://github.com/pxb1988/dex2jar/blob/b5bda4fb4935ae8b3869b422454ae3b3896c7bc1/README.md","description_en":"Java toolkit that converts Android DEX bytecode, including DEX inside APKs, into JVM .class files packed as a jar for Java decompilers and bytecode tools. It also reads and writes DEX through an ASM-like API, disassembles and assembles smali with its own implementation, converts jars back to DEX and ships helpers such as d2j-decrypt-string.","description_zh":"用 Java 编写的工具集，可将 Android DEX 字节码（包括 APK 内的 DEX 文件）转换为打包成 jar 的 JVM .class 文件，供 Java 反编译器和字节码工具使用。它还通过类似 ASM 的 API 读写 DEX，以自有实现进行 smali 反汇编与汇编，可将 jar 转回 DEX，并附带 d2j-decrypt-string 等辅助工具。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"binsync","name":"BinSync","name_zh":"BinSync 协同逆向插件","url":"https://github.com/binsync/binsync","evidence_url":"https://github.com/binsync/binsync/blob/07a2ce87638b25728564cbc5198e1bd945d4d70c/README.md","description_en":"Decompiler plugin for collaborative reverse engineering that records each analyst's work in a shared Git repository, one branch per user, so teammates can pull, push or auto-push changes across IDA Pro, Binary Ninja, Ghidra and angr-management. Synced artifacts are function headers (names, arguments and types), stack and global variables, structs, enums and comments, including user-defined types. It is built by mahaloz, the angr team and the SEFCOM research lab and is used by the Shellphish hacking team; scripting goes through the separate DecLib library.","description_zh":"用于协同逆向工程的反编译器插件，把每位分析者的工作记录在共享 Git 仓库中（每位用户一个分支），队友可在 IDA Pro、Binary Ninja、Ghidra 和 angr-management 之间拉取、推送或自动推送更改。可同步的内容包括函数头（名称、参数和类型）、栈变量和全局变量、结构体、枚举和注释，并支持用户自定义类型。它由 mahaloz、angr 团队和 SEFCOM 研究实验室开发，并被 Shellphish 黑客团队使用；脚本操作需借助独立的 DecLib 库。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"class-dump","name":"class-dump","name_zh":"class-dump Objective-C 头文件生成工具","url":"https://github.com/nygard/class-dump","evidence_url":"https://github.com/nygard/class-dump/blob/2c82b4ff12b2ea5d1ac23e49281d496997370841/README.md","description_en":"Command-line utility that reads the Objective-C runtime metadata in Mach-O executables, frameworks and bundles and prints it as ordinary Objective-C declarations for the classes, categories and protocols it finds, the same information otool -ov shows in a more compact form. It can write one header file per class, recurse into the frameworks a binary uses, choose one architecture from a universal binary, filter or sort the output, and annotate it with instance-variable offsets and implementation addresses.","description_zh":"一款命令行工具，读取 Mach-O 可执行文件、框架和 bundle 中的 Objective-C 运行时元数据，并将其中的类、类别和协议输出为常规的 Objective-C 声明；信息与 otool -ov 所显示的相同，但形式更紧凑。它可以为每个类生成一个头文件，递归展开二进制所用的框架，从通用二进制中选择单一架构，对输出进行筛选或排序，并标注实例变量偏移和方法实现地址。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"openawe-alan-wake-engine-case","name":"OpenAWE: an open reimplementation of Remedy’s Alan Wake engine","name_zh":"OpenAWE：Remedy 的 Alan Wake 引擎的开源重新实现","url":"https://github.com/OpenAWE-Project/OpenAWE","evidence_url":"https://github.com/OpenAWE-Project/OpenAWE/blob/cce15d3bc289df31522d778fb8e99180e6752b58/README.md","description_en":"Reimplements Remedy Entertainment’s Alan Wake engine, later known as Northlight, in C++ and OpenGL, aiming to run Alan Wake and Alan Wake’s American Nightmare portably from the user’s game data, with Quantum Break and possibly Control as later goals. README documents only a free camera for moving through loaded game data, and the American Nightmare script table implements 16 of its 278 native functions. The repository also includes command-line tools for the games’ archive, texture, Havok and sound formats.","description_zh":"以 C++ 和 OpenGL 重新实现 Remedy Entertainment 的 Alan Wake 引擎（后来称为 Northlight），目标是借助使用者自己的游戏数据，以可移植方式运行《心灵杀手》和《心灵杀手：美国梦魇》，并把《量子破碎》乃至《控制》列为后续目标。README 只介绍了一个用于在已加载游戏数据中移动的自由视角相机，《美国梦魇》的脚本函数表在 278 个原生函数中实现了 16 个。仓库还附带处理这些游戏的归档、纹理、Havok 和音频格式的命令行工具。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"cps2recomp-arcade-static-recomp-case","name":"CPS-2 Recomp: static recompilation of Capcom CPS-2 and CPS-1 arcade games","name_zh":"CPS-2 Recomp：Capcom CPS-2 与 CPS-1 街机游戏的静态重编译","url":"https://github.com/tmcleroy/cps2recomp","evidence_url":"https://github.com/tmcleroy/cps2recomp/blob/74e26fb10e166fbfacfb1e6520fbc05e400642b1/README.md","description_en":"Translates the 68000 game programs and Z80 sound programs of Capcom arcade boards ahead of time into C++ and runs them on a machine model written for the project, with an interpreter for code that has not been translated. One launcher covers Street Fighter Alpha and Alpha 2, Super Puzzle Fighter II Turbo, Vampire Savior and its variants, Vampire Hunter 2, Alien vs. Predator and the CPS-1 Cadillacs and Dinosaurs, adding training modes, widescreen and three-player options. Translated code is generated from the user’s own ROM sets, and a check build compares it block by block with the interpreter.","description_zh":"将 Capcom 街机基板上的 68000 游戏程序与 Z80 声音程序预先转译为 C++，并在为本项目编写的机器模型上运行，尚未转译的代码则交给解释器执行。一个启动器涵盖《街头霸王 Alpha》及《Alpha 2》、《超级益智战士 II Turbo》、《恶魔战士：救世主》及其变体、《恶魔猎人 2》、《异形大战铁血战士》以及 CPS-1 平台的《恐龙新世纪》，并加入训练模式、宽屏和三人游戏选项。转译代码由使用者自有的 ROM 套装生成，专门的检查构建会逐个代码块将其与解释器对比。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"binbloom","name":"binbloom","name_zh":"binbloom 原始固件端序与基址分析工具","url":"https://github.com/quarkslab/binbloom","evidence_url":"https://github.com/quarkslab/binbloom/blob/95cfaacf2dfcbeba51c7d09132f188331449ec24/README.md","description_en":"Quarkslab command-line tool that infers basic properties of a headerless raw firmware image from simple statistics on its content, which is why the README says it works with any architecture. It guesses endianness from how the high bytes of pointer-sized values cluster under each byte order, and ranks candidate loading (base) addresses by how many values would then point at indexed text strings and pointer arrays. Given a base address, it also searches automotive ECU firmware for a table of Unified Diagnostic Services (UDS) command IDs and prints the inferred structure layout for use in a disassembler.","description_zh":"Quarkslab 开发的命令行工具，通过对内容做简单统计来推断无文件头原始固件镜像的基本属性，因此 README 称其适用于所有架构。它根据指针宽度数值的高位字节在两种字节序下的聚集程度推测端序，并按候选加载地址（基址）下有多少数值会指向已索引的文本字符串和指针数组，对候选地址排序。给定基址后，它还能在汽车 ECU 固件中查找统一诊断服务（UDS）命令 ID 表，并输出推断出的结构体布局，供反汇编器使用。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"packetry","name":"Packetry","name_zh":"Packetry USB 2.0 协议分析工具","url":"https://github.com/greatscottgadgets/packetry","evidence_url":"https://github.com/greatscottgadgets/packetry/blob/5a7f98b77aa00519ecf7e811c9f26c6534966d05/README.md","description_en":"Great Scott Gadgets' USB 2.0 protocol analysis application for live capture with the Cynthion analyzer or for exploring previously captured traffic, working from physical-layer packet data at High, Full and Low Speed. Its GTK 4 interface offers a hierarchical view that expands high-level events into their transactions and packets, plus chronological transaction and packet views, while a device pane summarizes each observed device from its decoded descriptors, including HID report descriptors. Captures are opened and saved as pcap files with the LINKTYPE_USB_2_0 link type, and v0.5.0 added pcapng with custom blocks for non-packet events.","description_zh":"Great Scott Gadgets 推出的 USB 2.0 协议分析应用，可配合 Cynthion 分析仪实时捕获，也可浏览已捕获的流量，处理高速、全速和低速 USB 的物理层数据包。其 GTK 4 界面提供分层视图，可将高层事件逐级展开为事务和数据包，另有按时间顺序排列的事务视图和数据包视图；设备面板则根据解码后的描述符（包括 HID 报告描述符）汇总每个观察到的设备。捕获以 LINKTYPE_USB_2_0 链路类型的 pcap 文件打开和保存，v0.5.0 还加入了带有非数据包事件自定义块的 pcapng 格式。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"lucid-microcode-explorer","name":"Lucid","name_zh":"Lucid Hex-Rays 微码浏览器","url":"https://github.com/gaasedelen/lucid","evidence_url":"https://github.com/gaasedelen/lucid/blob/9f2480dc8e6bbb9421b5711533b0a98d2e9fb5af/README.md","description_en":"IDA Pro plugin by Markus Gaasedelen for studying how the Hex-Rays decompiler transforms its microcode intermediate language. Opened from a Pseudocode window with View microcode, its explorer stays synchronized with the pseudocode and lets the user scroll a selected microinstruction through each microcode maturity level, tracing sub-operands back to their origins and changing the cursor color when the traced code has been optimized away. Nested sub-instructions can be shown as tree graphs; the author labels it a developer-oriented prototype and code resource, not a general-purpose reverse-engineering tool.","description_zh":"Markus Gaasedelen 开发的 IDA Pro 插件，用于研究 Hex-Rays 反编译器如何逐步变换其微码（microcode）中间语言。在伪代码窗口中选择 View microcode 即可打开浏览器，它与伪代码保持同步，用户可让选中的微指令依次滚动经过各个微码成熟度层级，把子操作数追溯到来源；若追踪的代码已被优化掉，光标会变色提示。嵌套的子指令可显示为树状图；作者将其定位为面向开发者的原型和代码参考，而不是通用逆向工程工具。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"bluefluff-furby-connect-ble-case","name":"bluefluff: reverse engineering Furby Connect's Bluetooth LE protocol","name_zh":"bluefluff：逆向分析 Furby Connect 的蓝牙低功耗协议","url":"https://github.com/Jeija/bluefluff","evidence_url":"https://github.com/Jeija/bluefluff/blob/9e865c47326167c2d4e6f47d96321e8e5cfc0e32/README.md","description_en":"Documents the Bluetooth Low Energy interface of Hasbro's Furby Connect toy, worked out, according to its notes, from the companion app's native library, sniffed BLE traffic and trial and error. It maps the GATT services and the command and response bytes of the toy's Nordic radio and GeneralPlus controller, covering action sequences, antenna colour, mood values, sensor reports and a hidden debug screen. fluffd, a Node.js daemon built on the noble BLE library, exposes these commands through an HTTP API and a browser control page.","description_zh":"记录 Hasbro 玩具 Furby Connect 的蓝牙低功耗（BLE）接口；据其说明，这些内容来自对配套应用原生库的分析、BLE 流量嗅探和反复试验。文档梳理了 GATT 服务，以及玩具中 Nordic 无线芯片和 GeneralPlus 控制器的命令与响应字节，涵盖动作序列、天线颜色、情绪数值、传感器报告和一个隐藏的调试界面。fluffd 是基于 noble BLE 库的 Node.js 守护进程，通过 HTTP API 和浏览器控制页面提供这些命令。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"apk-sh","name":"apk.sh","name_zh":"apk.sh Android 应用分析脚本","url":"https://github.com/ax/apk.sh","evidence_url":"https://github.com/ax/apk.sh/blob/2a1ed25e861dacfb4fec1aef7b099813abff24ed/README.md","description_en":"Bash script that automates repetitive Android app analysis chores around apktool: pulling an installed package from a device or emulator, decoding resources and disassembling dex code, and rebuilding the decoded directory into an APK. Split APKs from app bundles are combined into a single APK when pulled, and the script can also prepare a copy for Frida instrumentation.","description_zh":"一个 Bash 脚本，围绕 apktool 自动完成 Android 应用分析中的重复性工作：从设备或模拟器拉取已安装的应用包、解码资源并反汇编 dex 代码，以及将解码后的目录重新构建为 APK。拉取 app bundle 的拆分 APK 时会将其合并为单个 APK，脚本还可以准备一份用于 Frida 插桩的副本。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"r2dec","name":"r2dec","name_zh":"r2dec radare2 反编译插件","url":"https://github.com/wargio/r2dec-js","evidence_url":"https://github.com/wargio/r2dec-js/blob/32ada0dc8bffd1e3ec55d6134531eaae244502ed/README.md","description_en":"Decompiler plugin for radare2 that turns the disassembly of an analyzed function into pseudo-C through the pdd command. Its decompiler is written in JavaScript, with one module per architecture, compiled to QuickJS bytecode and embedded in a native radare2 core plugin; output can sit beside the assembly or offsets, show only scope blocks, casts or cross-references, render as HTML, or be written back into radare2 as comments. The README lists x86/x64, 16/32/64-bit ARM, MIPS, PowerPC (including VLE), SPARC, AVR, V850 and Dalvik, plus experimental 6502, 8051, BPF, m68k, SuperH, WebAssembly and RISC-V support.","description_zh":"radare2 的反编译插件，通过 pdd 命令把已分析函数的反汇编转换为伪 C 代码。反编译器用 JavaScript 编写，每种架构对应一个模块，编译为 QuickJS 字节码后嵌入原生的 radare2 核心插件；输出可与汇编或偏移并排显示，可只显示作用域块，可显示类型转换或交叉引用，也可输出 HTML 或作为注释写回 radare2。README 列出的架构包括 x86/x64、16/32/64 位 ARM、MIPS、PowerPC（含 VLE）、SPARC、AVR、V850 和 Dalvik，另有实验性的 6502、8051、BPF、m68k、SuperH、WebAssembly 和 RISC-V 支持。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"m1n1","name":"m1n1","name_zh":"m1n1 Apple Silicon 引导与硬件研究工具","url":"https://github.com/AsahiLinux/m1n1","evidence_url":"https://github.com/AsahiLinux/m1n1/blob/7cde7d1a784d851ebfee5579fa363c38b14150c0/README.md","description_en":"Asahi Linux's bootloader and hardware-research environment for Apple Silicon Macs. It bridges Apple's boot chain to Linux by loading appended device trees, initramfs and kernels; in proxy mode a USB link lets a Python client probe hardware live and run macOS or Linux under m1n1's hypervisor while tracing its hardware accesses.","description_zh":"Asahi Linux 面向 Apple Silicon Mac 的引导程序与硬件研究环境。它将 Apple 的启动链衔接到 Linux，加载附加在其后的设备树、initramfs 和内核；在代理模式下，Python 客户端可通过 USB 连接实时探查硬件，并在 m1n1 的虚拟机监控器中运行 macOS 或 Linux，同时追踪其硬件访问。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"svd-loader-ghidra","name":"SVD-Loader for Ghidra","name_zh":"SVD-Loader：Ghidra CMSIS-SVD 外设映射脚本","url":"https://github.com/leveldown-security/SVD-Loader-Ghidra","evidence_url":"https://github.com/leveldown-security/SVD-Loader-Ghidra/blob/4b21fa54a1f516e25e959939f6e1251263c74725/README.md","description_en":"Ghidra script from leveldown security that reads a CMSIS-SVD file, the XML format describing a microcontroller's memory-mapped peripherals and their registers, and applies it to firmware already loaded in Ghidra. It creates memory blocks for the peripheral address ranges, a structure type for each peripheral with its registers as fields, and a label at each peripheral base address, so register accesses can be read by peripheral and register name. It targets little-endian Arm Cortex-M devices and bundles a fork of the cmsis-svd parser ported to Ghidra's Jython.","description_zh":"leveldown security 发布的 Ghidra 脚本，读取 CMSIS-SVD 文件（描述微控制器内存映射外设及其寄存器的 XML 格式），并将其应用到已载入 Ghidra 的固件上。它为外设地址范围创建内存块，为每个外设生成以寄存器为字段的结构体类型，并在各外设基址处添加标签，从而可按外设和寄存器名称阅读寄存器访问。它面向小端 Arm Cortex-M 设备，并附带一份移植到 Ghidra Jython 环境的 cmsis-svd 解析器分支。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"impacto-mages-engine-case","name":"impacto: a reimplementation of the MAGES. visual-novel engine","name_zh":"impacto：MAGES. 视觉小说引擎的重新实现","url":"https://github.com/CommitteeOfZero/impacto","evidence_url":"https://github.com/CommitteeOfZero/impacto/blob/b30493852424d32c7806307486fd33edfa0bc54a/README.md","description_en":"Reimplements the MAGES. visual-novel engine, used by the Science Adventure and Memories Off series, in C++ with OpenGL, running supported titles from the user’s original data files through per-game Lua profiles in one binary. README says all endings can be reached in at least one game, Memories Off 6 T-Wave, but no game is fully complete. The project’s tracking issue lists partial support for titles including Chaos;Head Love Chu Chu, Chaos;Child Love Chu Chu, Steins;Gate and Robotics;Notes Elite.","description_zh":"以 C++ 和 OpenGL 重新实现《科学冒险》系列和《告别回忆》系列所用的 MAGES. 视觉小说引擎，通过按游戏划分的 Lua 配置，在同一个程序中运行使用者原版数据文件里的受支持作品。README 称至少有一款游戏（Memories Off 6 T-Wave）可以达成全部结局，但还没有任何游戏完全实现。项目的跟踪议题列出了对 Chaos;Head Love Chu Chu、Chaos;Child Love Chu Chu、Steins;Gate、Robotics;Notes Elite 等作品的部分支持。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"caringcaribou","name":"Caring Caribou","name_zh":"Caring Caribou 汽车 CAN 总线安全探索工具","url":"https://github.com/CaringCaribou/caringcaribou","evidence_url":"https://github.com/CaringCaribou/caringcaribou/blob/092eff3c2c95bb7952a2a92ac12b6c1c29035b70/README.md","description_en":"Python automotive security exploration tool, begun in the HEAVENS research project, that the README describes as a zero-knowledge tool to drop onto a CAN network and collect information about the services present. Passive modules dump CAN traffic to the terminal or a candump-format file and list every arbitration ID seen on the bus, while the UDS (ISO 14229-1), DoIP (ISO 13400-2) and XCP modules discover ECUs that answer diagnostic requests, enumerate their supported services and subservices, read data identifiers and query XCP capabilities. Its utilities provide reusable ISO-TP (ISO 15765-2) and UDS implementations, and new modules plug into a drop-in module architecture.","description_zh":"Python 编写的汽车安全探索工具，起源于 HEAVENS 研究项目；README 称它是一种无需预先了解目标的工具，可接入任意 CAN 网络并收集其中存在哪些服务的信息。被动模块可将 CAN 流量输出到终端或 candump 格式文件，并列出总线上出现的所有仲裁 ID；UDS（ISO 14229-1）、DoIP（ISO 13400-2）和 XCP 模块则可发现响应诊断请求的 ECU，枚举其支持的服务和子服务，读取数据标识符并查询 XCP 能力。其工具库提供可复用的 ISO-TP（ISO 15765-2）和 UDS 实现，新模块可通过即插即用的模块架构加入。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"rms-runtime-mobile-security","name":"Runtime Mobile Security (RMS)","name_zh":"Runtime Mobile Security（RMS）移动应用运行时分析界面","url":"https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security","evidence_url":"https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security/blob/d07212e7edec20b14e3108860bebb4f0e8fffe40/README.md","description_en":"Frida-based web interface for observing Android and iOS apps at run time on a test device. It lists the classes and methods loaded in memory, traces method arguments and return values, generates hook templates for a selected class, finds class instances on the heap, and on Android monitors categorized framework APIs and a few libc file functions; a beta file browser covers the app's private folders.","description_zh":"基于 Frida 的 Web 界面，用于在测试设备上观察运行中的 Android 与 iOS 应用。它可列出内存中已加载的类和方法，跟踪方法参数与返回值，为选定的类生成 Hook 模板，在堆上查找类实例；在 Android 上还能按类别监控框架 API 以及少数 libc 文件函数。另有处于测试阶段的文件浏览器，可查看应用的私有目录。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"pharos","name":"Pharos","name_zh":"Pharos 二进制静态分析框架","url":"https://github.com/cmu-sei/pharos","evidence_url":"https://github.com/cmu-sei/pharos/blob/782492fe3b854c02f3b6257e9be3b6de87be1960/README.md","description_en":"Carnegie Mellon SEI's framework of automated static analysis tools for binary programs, built on LLNL's ROSE compiler infrastructure for disassembly, control-flow analysis and instruction semantics. Its best-known tool, OOAnalyzer, recovers C++ classes, methods and other object-oriented constructs from 32-bit x86 executables built with Microsoft Visual C++ by applying Prolog rules to facts about how object pointers move between functions, as described in a CCS 2018 paper, and exports JSON for an included IDA plugin or the separate Kaiju Ghidra plugin. Other tools find API call sequences (ApiAnalyzer), report static API-call parameters (CallAnalyzer), produce function hashes and YARA signatures for similarity analysis (FN2Hash, FN2Yara) and work out the conditions for reaching one address from another (PathAnalyzer).","description_zh":"卡内基梅隆大学软件工程研究所（SEI）推出的二进制程序自动化静态分析工具框架，基于劳伦斯利弗莫尔国家实验室的 ROSE 编译器基础设施完成反汇编、控制流分析和指令语义建模。其中最知名的 OOAnalyzer 跟踪对象指针在函数之间的传递，再用 Prolog 规则从这些事实中恢复 C++ 类、方法等面向对象结构，适用于 Microsoft Visual C++ 编译的 32 位 x86 可执行文件，方法见 CCS 2018 论文；结果以 JSON 导出，可供仓库自带的 IDA 插件或独立的 Kaiju Ghidra 插件使用。其他工具可查找 API 调用序列（ApiAnalyzer）、报告 API 调用的静态参数（CallAnalyzer）、生成用于相似性分析的函数哈希和 YARA 签名（FN2Hash、FN2Yara），以及求出从一个地址到达另一地址所需的条件（PathAnalyzer）。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"heimdall-rs","name":"heimdall-rs","name_zh":"heimdall-rs EVM 字节码分析工具包","url":"https://github.com/Jon-Becker/heimdall-rs","evidence_url":"https://github.com/Jon-Becker/heimdall-rs/blob/9de15de029ac1128c7c7566672d472f104a9747a/README.md","description_en":"Rust toolkit by Jonathan Becker for analyzing EVM smart-contract bytecode, particularly of contracts without verified source. Its CLI disassembles bytecode, builds control-flow graphs, decompiles it through per-function symbolic execution and heuristic post-processing passes into an ABI plus beta Solidity or Yul source, decodes raw calldata, dumps the storage slots a contract accesses over a block range, and inspects transactions by decoding their calldata, traces and logs. Targets can be raw bytecode, files, contract addresses or ENS names; function selectors are resolved against the OpenChain signature database unless that step is skipped.","description_zh":"Jonathan Becker 用 Rust 编写的 EVM 智能合约字节码分析工具包，尤其适用于未公开验证源码的合约。其命令行可反汇编字节码、生成控制流图，借助逐函数的符号执行和启发式后处理把字节码反编译为 ABI 以及测试阶段的 Solidity 或 Yul 源码，还能解码原始 calldata、导出合约在某一区块范围内访问的存储槽，并通过解码 calldata、调用跟踪和日志来检查交易。分析目标可以是原始字节码、文件、合约地址或 ENS 名称；函数选择器默认通过 OpenChain 签名数据库解析，也可跳过这一步。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"uefi-firmware-parser","name":"UEFI Firmware Parser","name_zh":"UEFI Firmware Parser 固件结构解析工具","url":"https://github.com/theopolis/uefi-firmware-parser","evidence_url":"https://github.com/theopolis/uefi-firmware-parser/blob/c4b8c64e7a1ca647b68db99db80ef0410d9afe79/README.rst","description_en":"Python library and uefi-firmware-parser command for identifying, parsing and extracting PC firmware images: UEFI firmware volumes, capsules, firmware file systems, files and sections, Intel PCH flash descriptors, Intel ME modules and Dell PFS update packages. An AutoParser picks the format, or a brute-force scan looks for volumes and other known objects inside an unidentified blob; results print as an object hierarchy or dump to files, with Tiano/EFI and LZMA sections decompressed by a bundled C extension. Helper scripts replace a section or file by GUID inside a volume, generate an FDF flash description from parsed volumes and output GUID labels for IDA scripts.","description_zh":"Python 库及 uefi-firmware-parser 命令行工具，用于识别、解析和提取 PC 固件镜像：UEFI 固件卷、胶囊（capsule）、固件文件系统、文件与节（section），以及 Intel PCH Flash Descriptor、Intel ME 模块和 Dell PFS 更新包。AutoParser 可自动判断格式，暴力扫描模式则在未识别的数据块中查找固件卷及其他已知对象；结果可打印为对象层级或导出为文件，Tiano/EFI 与 LZMA 压缩的节由内置 C 扩展解压。附带的脚本可按 GUID 替换固件卷中的节或文件，根据解析出的固件卷生成 FDF 闪存描述文件，并输出供 IDA 脚本使用的 GUID 标签。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"noop-whoop-ble-client-case","name":"NOOP: an offline WHOOP strap client built from Bluetooth protocol research","name_zh":"NOOP：基于蓝牙协议研究构建的离线 WHOOP 手环客户端","url":"https://github.com/ryanbr/noop","evidence_url":"https://github.com/ryanbr/noop/blob/8e4b0c16e7640607600fa6bde5424095eba6034e/README.md","description_en":"Replaces the WHOOP companion app with offline macOS, Android and iOS clients that pair with WHOOP 4.0 and 5.0/MG straps over Bluetooth, decode their vendor GATT frames, offload the strap’s history into local SQLite and compute recovery, strain, HRV and sleep on the device. A versioned protocol reference documents framing, checksums, commands and sensor records per strap family, building on the community my-whoop and goose projects. WHOOP 4.0 is the supported path; deeper WHOOP 5.0/MG metrics and Oura ring support remain experimental.","description_zh":"以离线的 macOS、Android 和 iOS 客户端取代 WHOOP 官方配套应用：通过蓝牙与 WHOOP 4.0 及 5.0/MG 手环配对，解析其厂商自定义 GATT 帧，将手环中的历史数据转存到本地 SQLite，并在设备上计算恢复度、负荷、HRV 和睡眠。按手环型号分版本编写的协议参考记录了帧格式、校验、命令和传感器记录，建立在社区项目 my-whoop 与 goose 的成果之上。WHOOP 4.0 是受支持的路径；WHOOP 5.0/MG 的深层指标和 Oura 戒指支持仍属实验性。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"pe-bear","name":"PE-bear","name_zh":"PE-bear PE 文件分析工具","url":"https://github.com/hasherezade/pe-bear","evidence_url":"https://github.com/hasherezade/pe-bear/blob/b90f1d7d96635e7a029f424a0d1d11a104821685/README.md","description_en":"Qt GUI to view and edit Windows Portable Executable files, meant as a fast first look for malware analysts and robust against malformed PE32 and PE64 files. It shows headers and section layout, follows raw, RVA and VA addresses, disassembles from any offset with Capstone, matches packer signatures, compares two files and unmaps dumped images.","description_zh":"用于查看和编辑 Windows 可移植可执行（PE）文件的 Qt 图形工具，旨在为恶意软件分析人员提供快速的初步查看，并能稳定处理畸形的 PE32 与 PE64 文件。它可显示文件头和节区布局，跟随原始偏移、RVA 和 VA 地址，借助 Capstone 从任意偏移开始反汇编，按签名识别加壳工具，对比两个文件，并能还原从内存转储的映像。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"protodump","name":"protodump","name_zh":"protodump Protobuf 定义恢复工具","url":"https://github.com/arkadiyt/protodump","evidence_url":"https://github.com/arkadiyt/protodump/blob/d398fada3452b87e6f0879d9cdf3dad31bb74d6e/README.md","description_en":"Go command-line utility that recovers Protocol Buffers schemas from a compiled binary or any other file: it scans the raw bytes for serialized FileDescriptorProto records embedded by generated code, locating them through their .proto file names, and writes each one back out as a .proto source file under its original descriptor path. The regenerated files use proto2, proto3 or editions syntax and include the package, imports, common file options, messages with reserved ranges, nested enums, oneofs, maps and default values, and services with their RPC methods, giving analysts message and API definitions to work with when decoding Protobuf traffic.","description_zh":"Go 编写的命令行工具，可从已编译的二进制或其他任意文件中恢复 Protocol Buffers 模式：它在原始字节中搜索生成代码嵌入的序列化 FileDescriptorProto 记录（借助其中的 .proto 文件名定位），并按原描述符路径将每条记录重新写成 .proto 源文件。重新生成的文件采用 proto2、proto3 或 editions 语法，包含包名、导入、常用文件选项，带保留范围的消息、嵌套枚举、oneof、map 与默认值，以及服务及其 RPC 方法，为分析者解码 Protobuf 流量提供消息和接口定义。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["binary","protocol"],"verified_at":"2026-10-19"},{"id":"pre-list","name":"PRE-list","name_zh":"PRE-list 网络协议逆向工程论文清单","url":"https://github.com/techge/PRE-list","evidence_url":"https://github.com/techge/PRE-list/blob/9c18f7c8f00978ec70ba285a5f13b461ede12e93/README.md","description_en":"A table-based reading list of 71 research papers on automatic protocol reverse engineering for network protocols, from the Protocol Informatics project (2004) to NetPlier (2021). Built from three surveys and extended since, it compares each method by approach, by input (network traces or execution traces) and output (message formats, state machines or other artifacts), and by the text, binary or hybrid protocols it was evaluated on, with full references and a short table of the few papers that released code.","description_zh":"以表格形式整理的网络协议自动化逆向工程研究清单，收录 71 篇论文，从 2004 年的 Protocol Informatics 项目到 2021 年的 NetPlier。清单以三篇综述为基础并持续扩充，按所用方法、输入（网络流量记录或执行轨迹）与输出（报文格式、状态机或其他产物），以及评估所用的文本、二进制或混合协议对各方法进行比较，附完整参考文献，另有一张列出少数公开代码论文的简表。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"restringer","name":"REstringer","name_zh":"REstringer JavaScript 反混淆工具","url":"https://github.com/HumanSecurity/restringer","evidence_url":"https://github.com/HumanSecurity/restringer/blob/d9eae6907e14581b7934940ee0407f505b7a212b/README.md","description_en":"HUMAN Security's Node.js JavaScript deobfuscator. It identifies the obfuscation type, runs matching processors for obfuscator.io, Caesar Plus and array-based patterns, then iterates 40+ AST modules that rebuild strings, resolve expressions and calls and simplify control flow; unsafe modules evaluate code in a sandbox. It works as a CLI or library.","description_zh":"HUMAN Security 推出的 Node.js JavaScript 反混淆工具。它先识别混淆类型，针对 obfuscator.io、Caesar Plus 和基于数组的混淆模式运行相应处理器，再迭代执行 40 多个 AST 模块，重建字符串、求解表达式和函数调用并简化控制流；其中不安全模块会在沙箱中求值代码。可作为命令行工具或库使用。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"emproof-firmware-re-workshop","name":"Emproof workshop: Firmware Reverse Engineering","name_zh":"Emproof 固件逆向工程研讨会","url":"https://github.com/emproof-com/workshop_firmware_reverse_engineering","evidence_url":"https://github.com/emproof-com/workshop_firmware_reverse_engineering/blob/10dc72a199f2a70c2274b08ff5773412df6d035b/README.md","description_en":"Slides and 14 self-contained exercises from Emproof's firmware reverse-engineering workshop at ScapyCon Automotive 2025, designed by Tim Blazytko for a technical audience with little security experience. The firmware and binary tasks move from reading ELF metadata with binutils and first steps in Ghidra or Binary Ninja, through unpacking two embedded-Linux CTF images with binwalk, to bare-metal analysis: identifying the microcontroller, toolchain and memory map of a model car's firmware ELF, and rebasing a raw STM32F103 flash dump with segments taken from the datasheet. Other tasks decrypt strings statically in a Mirai sample and trace a hardcoded AES key back to its data section.","description_zh":"Emproof 在 ScapyCon Automotive 2025 上举办的固件逆向工程研讨会的幻灯片和 14 个独立练习，由 Tim Blazytko 设计，面向安全经验不多的技术人员。固件与二进制相关练习由浅入深：先用 binutils 读取 ELF 元数据并初步上手 Ghidra 或 Binary Ninja，再用 binwalk 解包两个嵌入式 Linux CTF 镜像，最后进行裸机分析，包括识别一辆模型车固件 ELF 的微控制器、工具链和内存映射，以及依据数据手册定义内存段，为一份原始 STM32F103 闪存转储重设基址。另有练习在 Mirai 样本中静态解密字符串，并把硬编码的 AES 密钥回溯到其所在数据段。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"pyatv-apple-tv-airplay-protocols-case","name":"pyatv: a reverse-engineered client for Apple TV and AirPlay protocols","name_zh":"pyatv：逆向工程实现的 Apple TV 与 AirPlay 协议客户端","url":"https://github.com/postlund/pyatv","evidence_url":"https://github.com/postlund/pyatv/blob/b277a4c8222ecdcbaab8a24e3e713ca44765adb4/docs/documentation/protocols.md","description_en":"Asyncio Python library and command-line tools that act as an independent client for Apple TV and AirPlay devices by reimplementing the DMAP/DACP, Media Remote Protocol, Companion Link, AirPlay and RAOP protocols, which its protocol documentation describes as reverse engineered. That page records the recovered binary formats, Zeroconf properties, the OPACK encoding, pair-setup and pair-verify exchanges and Companion commands, with some request headers taken from Wireshark captures of the iPhone Remote app, and the bundled atvproxy relays MRP, Companion and AirPlay sessions to print decrypted messages for further analysis. On this basis pyatv provides remote control, metadata with push updates, app and account switching, audio-output management and AirPlay streaming to Apple TVs, HomePods and third-party receivers.","description_zh":"基于 asyncio 的 Python 库和命令行工具，通过重新实现 DMAP/DACP、Media Remote Protocol、Companion Link、AirPlay 和 RAOP 协议，充当 Apple TV 与 AirPlay 设备的独立客户端；其协议文档称这些协议均经逆向工程得出。该文档记录了恢复出的二进制格式、Zeroconf 属性、OPACK 编码、pair-setup 与 pair-verify 交互以及 Companion 命令，其中部分请求头取自 iPhone Remote 应用的 Wireshark 抓包；附带的 atvproxy 可中继 MRP、Companion 和 AirPlay 会话并打印解密后的消息，供进一步分析。在此基础上，pyatv 提供遥控、带推送更新的元数据、应用与账户切换、音频输出管理，以及向 Apple TV、HomePod 和第三方接收器的 AirPlay 推流。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"lisa-lldb-mcp","name":"lisa.py","name_zh":"lisa.py：LLDB 的 MCP 集成与调试辅助命令","url":"https://github.com/ant4g0nist/lisa.py","evidence_url":"https://github.com/ant4g0nist/lisa.py/blob/9dd61e9dfc52668616634a024bf46ee2dc056852/README.md","description_en":"LLDB extension that adds an MCP bridge to a debugging session, adapted from ida-pro-mcp: the plugin's mcp start command serves 18 debugger functions over local JSON-RPC, and a FastMCP stdio server generated from those functions exposes them to MCP clients such as Claude Desktop. The tools create, launch or attach to targets, step, manage breakpoints, read backtraces, variables, disassembly and memory, evaluate expressions and run arbitrary LLDB commands. The same script keeps lisa.py's earlier exploit-development helpers, including checksec, a register and stack context view, Mach-O header and load-command display, Capstone disassembly and an exploitable crash-triage command.","description_zh":"为 LLDB 调试会话加入 MCP 桥接的扩展，改编自 ida-pro-mcp：插件的 mcp start 命令通过本地 JSON-RPC 提供 18 个调试器函数，再由依据这些函数生成的 FastMCP stdio 服务器把它们开放给 Claude Desktop 等 MCP 客户端。这些工具可创建、启动或附加调试目标，单步执行，管理断点，读取调用栈、变量、反汇编和内存，计算表达式，并可执行任意 LLDB 命令。同一脚本还保留了 lisa.py 早先的漏洞利用开发辅助命令，包括 checksec、寄存器与栈上下文视图、Mach-O 文件头与加载命令显示、Capstone 反汇编，以及用于崩溃分级的 exploitable 命令。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"wiremcp","name":"WireMCP","name_zh":"WireMCP 基于 tshark 的流量分析 MCP 服务器","url":"https://github.com/0xKoda/WireMCP","evidence_url":"https://github.com/0xKoda/WireMCP/blob/7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e/README.md","description_en":"Node.js MCP server that runs Wireshark's tshark for LLM clients, aimed in its README at threat hunting, network diagnostics and anomaly detection. Three tools capture a few seconds of live traffic and return either a fixed set of IP, port, TCP-flag and HTTP fields, tshark's protocol-hierarchy statistics or TCP conversation statistics; analyze_pcap returns IPs, ports, HTTP URLs and protocol stacks from a saved capture. The remaining tools match captured IPs against the URLhaus blocklist and scan a capture for HTTP Basic, FTP, Telnet and Kerberos credentials, beside the dissection output.","description_zh":"基于 Node.js 的 MCP 服务器，为 LLM 客户端调用 Wireshark 的 tshark；其 README 将用途定位于威胁狩猎、网络诊断和异常检测。三个工具会实时抓取数秒流量，分别返回一组固定的 IP、端口、TCP 标志和 HTTP 字段，tshark 的协议层级统计，或 TCP 会话统计；analyze_pcap 则从已保存的抓包文件中返回 IP、端口、HTTP URL 和协议栈。解析输出之外，其余工具会把抓到的 IP 与 URLhaus 黑名单比对，或在抓包文件中扫描 HTTP Basic、FTP、Telnet 和 Kerberos 凭据。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"wind-waker-hd-decomp-case","name":"Wind Waker HD decompilation: functions verified against the recompiled Wii U game","name_zh":"《风之杖 HD》反编译：与重编译的 Wii U 版逐函数比对验证","url":"https://github.com/ZeldaWWHDDecomp/wwhd","evidence_url":"https://github.com/ZeldaWWHDDecomp/wwhd/blob/b2811a3ce838d1f875bc8e68536c1950af5d7ffc/README.md","description_en":"Decompiles the USA Wii U release of The Wind Waker HD function by function into readable C++ in zeldaret/tww’s style, and verifies each function by running it beside the original, statically recompiled from the user’s own copy, comparing return values, memory writes and calls on generated and recorded inputs, with coverage and mutation checks. README reports 28,244 of the game’s 39,713 functions verified, including 22,068 of 22,215 GameCube-derived functions. The code calls undecompiled functions by address, so it runs only inside the ZeldaWWHDRecomp port, not as a standalone game build.","description_zh":"将 Wii U 美版《塞尔达传说 风之杖 HD》逐个函数反编译为 zeldaret/tww 风格的可读 C++，并让每个函数与由使用者自有副本静态重编译得到的原版函数并排运行，在生成输入和录制输入上比较返回值、内存写入和函数调用，同时检查覆盖率并进行变异测试。README 报告游戏 39,713 个函数中已有 28,244 个通过验证，其中来自 GameCube 版的 22,215 个函数里有 22,068 个。代码通过地址调用尚未反编译的函数，因此只能在 ZeldaWWHDRecomp 移植中运行，不能单独构建成游戏。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"siegefx-dungeon-siege-engine-case","name":"SiegeFX: a Dungeon Siege engine reimplementation in alpha","name_zh":"SiegeFX：处于 alpha 阶段的 Dungeon Siege 引擎重实现","url":"https://github.com/codingncaffeine/SiegeFX","evidence_url":"https://github.com/codingncaffeine/SiegeFX/blob/6a1a4ade725a860651a06a0d7ddb50d5a3a688d1/README.md","description_en":"A C#/.NET 10 engine loads Dungeon Siege's original archives, scripts and models, with published alpha builds and an audit/parity ledger. The project also provides SiegeSmith modding tools, while describing remaining fidelity and playthrough risks.","description_zh":"C#/.NET 10 引擎加载 Dungeon Siege 原始归档、脚本与模型，提供 alpha 构建和审计/一致性清单，并附带 SiegeSmith 模组工具；项目仍记录保真度和通关行为风险。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-01T16:36:25Z"},{"id":"legend-of-legaia-rust-port-case","name":"Legend of Legaia: a Rust port with disc-local browser tooling","name_zh":"Legend of Legaia：Rust 移植与本地读盘的浏览器工具","url":"https://github.com/AndrewAltimit/legend-of-legaia-re","evidence_url":"https://github.com/AndrewAltimit/legend-of-legaia-re/blob/f801d3c319386f7686d7fde45e114e1e2ba6aff5/README.md","description_en":"A from-scratch Rust port of the North American PlayStation Legend of Legaia includes native/browser play, asset extraction and disc patching. The author documents Ghidra/emulator research and a full-game ladder; this is a fresh implementation, not a matching decompilation or static recompilation.","description_zh":"从零编写的 Rust 移植面向北美 PlayStation 版 Legend of Legaia，附带原生/浏览器游玩、素材提取及光盘补丁工具；作者记录 Ghidra/模拟器研究与全流程测试阶梯，项目不是匹配反编译或静态重编译。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-01T16:36:25Z"},{"id":"crxviewer","name":"Chrome extension source viewer (CRX Viewer)","name_zh":"CRX Viewer 浏览器扩展源码查看器","url":"https://github.com/Rob--W/crxviewer","evidence_url":"https://github.com/Rob--W/crxviewer/blob/c1a0a7f63983600a960e3d02d8a36c4142c7cca4/README.md","description_en":"Browser extension and web page by Rob Wu for inspecting packaged browser extensions without installing them. On Chrome Web Store, Opera, Firefox, Thunderbird and Microsoft Edge add-on pages it adds a button that downloads the package as a zip or opens it in a viewer, and links to extension packages hosted elsewhere can be opened as well. The viewer reads CRX, NEX, XPI and ZIP files: it lists and filters files, searches content by string or regular expression, beautifies and syntax-highlights code, previews images, opens nested zips, shows per-file hashes and derives the extension ID from the package key, signature or manifest.","description_zh":"Rob Wu 开发的浏览器扩展及网页版工具，无需安装即可查看已打包的浏览器扩展。在 Chrome 网上应用店、Opera、Firefox、Thunderbird 和 Microsoft Edge 的扩展页面上，它会添加一个按钮，可将扩展包下载为 zip 或在查看器中打开；托管在其他位置的扩展包链接也能打开。查看器支持 CRX、NEX、XPI 和 ZIP 文件：可列出并筛选文件，按字符串或正则表达式搜索内容，格式化代码并高亮语法，预览图片，打开嵌套的 zip，显示各文件的哈希值，还能根据扩展包的公钥、签名或 manifest 推算扩展 ID。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"har-to-openapi","name":"har-to-openapi","name_zh":"har-to-openapi：从 HAR 抓包推断 OpenAPI 文档","url":"https://github.com/jonluca/har-to-openapi","evidence_url":"https://github.com/jonluca/har-to-openapi/blob/432e096aa1d7814a39dcf772f40dc93cdd9c1620/README.md","description_en":"TypeScript library and CLI that infers OpenAPI 3.0 or 3.1 documents from HAR captures of HTTP traffic, loosely based on har2openapi. Requests are grouped into one document per domain, with options to turn IDs in paths into parameters, infer query, form and JSON body schemas from observed values, and merge several captures into the same operations. Optional settings extract reusable component schemas, keep multiple redacted examples, mark fields required only when every sample contains them, attach per-field observation counts as evidence and apply an OpenAPI Overlay so hand-written names and corrections survive regeneration.","description_zh":"TypeScript 库及命令行工具，可根据 HTTP 流量的 HAR 抓包记录推断 OpenAPI 3.0 或 3.1 文档，大致基于 har2openapi 改写。请求按域名分别生成文档，可选择把路径中的 ID 转为参数，根据观测值推断查询参数、表单和 JSON 请求体的结构，并把多份抓包合并到相同的操作中。可选设置还能提取可复用的组件模式、保留多个经脱敏的示例、仅在所有样本都包含某字段时才将其标为必填、附加逐字段的观测计数作为依据，并应用 OpenAPI Overlay，使手工补充的名称和修正在重新生成后得以保留。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"rsdkv3-sonic-cd-decomp-case","name":"RSDKv3 Decompilation: Sonic CD (2011) on a reconstructed Retro Engine v3","name_zh":"RSDKv3 Decompilation：在重建的 Retro Engine v3 上运行 Sonic CD（2011）","url":"https://github.com/RSDKModding/RSDKv3-Decompilation","evidence_url":"https://github.com/RSDKModding/RSDKv3-Decompilation/blob/c01fc0c360e8e35e791630407ea5c7a426718e54/README.md","description_en":"Reconstructs Retro Engine v3, the engine behind the 2011 Sonic CD remaster, as a native C++ source port for Windows, Linux, macOS and Android. The engine runs the game's own scripts and assets from an official release, which the repository does not ship, and adds a mod loader, a settings file with remappable controls, support for the mobile versions' updated scripts and extra developer-menu debug keys. Its license describes the code as mostly functionally the same as the original rather than byte-matching; the same team's RSDKv5 decompilation is listed as a separate case.","description_zh":"重建 Retro Engine v3，即 2011 年 Sonic CD 重制版所用的引擎，作为可在 Windows、Linux、macOS 和 Android 上运行的原生 C++ 源码移植。引擎运行官方发行版中的游戏脚本和素材，仓库本身不附带这些内容；项目还加入了模组加载器、可重映射按键的设置文件、对移动版更新脚本的支持，以及更多开发者菜单调试快捷键。其许可证称代码大多在功能上与原作相同，而不是逐字节一致；同一团队的 RSDKv5 反编译另作独立案例收录。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"ico-matching-decomp-case","name":"ICO decompilation: byte-identical PAL and Japanese PlayStation 2 boot ELFs","name_zh":"《ICO》反编译：逐字节一致的 PAL 与日版 PlayStation 2 启动 ELF","url":"https://github.com/nathanialf/ico","evidence_url":"https://github.com/nathanialf/ico/blob/73f7365df143bc1ff48771af479fd68c66550d19/README.md","description_en":"Rebuilds the boot ELFs of ICO’s PAL (SCES-50760) and Japanese (SCPS-11003) PlayStation 2 discs from one source tree with the game’s original compiler versions, and checks that every loaded byte and the whole ELF file match the disc’s SHA-1. The 73 data-only archive members are generated at build time from the user’s own ELF, so most read-only data still comes from the disc rather than from source. Separate branches target the USA, Korean and August 2001 prototype builds, and the catalog’s ICO PC port is a fork of this tree.","description_zh":"以同一套源码和游戏原用的编译器版本，重建《ICO》PAL 版（SCES-50760）与日版（SCPS-11003）PlayStation 2 光盘的启动 ELF，并检查载入的每个字节以及整个 ELF 文件都与光盘的 SHA-1 一致。73 个只含数据的归档成员在构建时由使用者自己的 ELF 生成，因此大部分只读数据仍取自光盘而非源码。另有独立分支面向美版、韩版和 2001 年 8 月原型版，本目录收录的 ICO PC 移植即是这套源码的分叉。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"esp32-bit-pirate","name":"ESP32 Bit Pirate","name_zh":"ESP32 Bit Pirate 多协议硬件工具固件","url":"https://github.com/geo-tp/ESP32-Bit-Pirate","evidence_url":"https://github.com/geo-tp/ESP32-Bit-Pirate/blob/8a91778e25b699c59f34542d8ea8d405fa7e4020/README.md","description_en":"Open-source firmware that turns ESP32-S3 boards into a Bus Pirate-inspired multi-protocol hardware tool, operated from a USB serial terminal, a Wi-Fi web CLI or the M5 Cardputer's own keyboard and screen. Its modes talk to, sniff and script I2C, SPI, UART, 1-Wire, CAN and other buses, read EEPROM and flash chips, and scan for JTAG and SWD pinouts. USB adapter modes let host tools such as flashrom, OpenOCD and sigrok/PulseView use the board as an SPI programmer, debug adapter or logic analyzer.","description_zh":"开源固件，可把 ESP32-S3 开发板变成受 Bus Pirate 启发的多协议硬件工具，通过 USB 串口终端、Wi-Fi 网页命令行，或直接用 M5 Cardputer 自带的键盘和屏幕操作。各模式可与 I2C、SPI、UART、1-Wire、CAN 等总线通信、嗅探并编写脚本，读取 EEPROM 和闪存芯片，还能扫描 JTAG 与 SWD 引脚。USB 适配器模式让 flashrom、OpenOCD、sigrok/PulseView 等主机工具把开发板当作 SPI 编程器、调试适配器或逻辑分析仪使用。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware","protocol"],"verified_at":"2026-10-20"},{"id":"decode-js","name":"decode-js","name_zh":"decode-js JavaScript 反混淆 AST 工具","url":"https://github.com/echo094/decode-js","evidence_url":"https://github.com/echo094/decode-js/blob/ca4690abacd3dc3666363769a7e846758e7311e9/README.md","description_en":"Babel-based AST processor that turns obfuscated JavaScript back into readable source, with one target selected per run: javascript-obfuscator (obfuscator.io), JS-Confuser 2.x up to its high preset, sojson and its v7 variant for jsjiami.com.v7, sojson's jjencode variant, and a generic pass for unreachable code, nested blocks and constant expressions. A second, version-aware obfuscator.io target reports the encoder era it detects and returns nothing, with a reason, rather than a half-decoded program when a string-array layer cannot be read. The JS-Confuser notes list each transform it reverses and those, such as variable renaming, that destroy information and cannot be recovered.","description_zh":"基于 Babel AST 的处理工具，可把混淆过的 JavaScript 还原为可读源码，每次运行选择一个目标：javascript-obfuscator（obfuscator.io）、JS-Confuser 2.x（直至 high 预设）、sojson 及其面向 jsjiami.com.v7 的 v7 变体、sojson 风格的 jjencode，以及处理不可达代码、嵌套代码块和常量表达式的通用目标。另一个按版本区分的 obfuscator.io 目标会报告检测到的编码器版本区间；遇到无法读取的字符串数组层时，它不输出结果并说明原因，而不是给出解了一半的程序。JS-Confuser 文档逐项列出可还原的变换，以及变量重命名等会丢失信息、无法恢复的变换。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-20"},{"id":"niimblue-niimbot-printer-client-case","name":"NiimBlue: an independent web client for NIIMBOT label printers","name_zh":"NiimBlue：NIIMBOT 标签打印机的独立网页客户端","url":"https://github.com/MultiMote/niimblue","evidence_url":"https://github.com/MultiMote/niimblue/blob/82c5605780818299422a6acdf3180d87c569578d/README.md","description_en":"Replaces NIIMBOT's own label app with a browser client that designs labels and prints them over Web Bluetooth or Web Serial, with Android (Capacitor) and Windows (Tauri) builds of the same interface. Printer communication comes from the same author's NiimBlueLib, which the README calls the most complete implementation of the NIIMBOT protocol; the protocol is documented on the NIIMBOT Community Wiki, and owners of models that do not print are asked for a packet capture of a print made with the official app. The README says the client runs entirely in the browser and keeps label data there.","description_zh":"以浏览器客户端替代 NIIMBOT 官方标签应用，可设计标签并通过 Web Bluetooth 或 Web Serial 打印，同一界面另有 Android（Capacitor）和 Windows（Tauri）版本。与打印机的通信由同一作者的 NiimBlueLib 实现，README 称其为最完整的 NIIMBOT 协议实现；协议记录在 NIIMBOT Community Wiki 上，打印失败机型的用户会被请求提供用官方应用打印时的数据包抓包。README 称客户端完全在浏览器中运行，标签数据也保存在浏览器里。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-20"},{"id":"firerpa-lamda","name":"FIRERPA (lamda)","name_zh":"FIRERPA（lamda）Android 自动化与动态分析平台","url":"https://github.com/firerpa/lamda","evidence_url":"https://github.com/firerpa/lamda/blob/a980a38130ba00711311e509e3009301e8ff705a/README.md","description_en":"Client/server Android automation and dynamic-analysis platform for devices the analyst is authorized to test. An on-device server exposes UI automation, a browser-based remote desktop, HTTPS traffic capture (MITM), and bundled Frida instrumentation through one service, driven from a Python client library of 160+ APIs. The README reports it works on Android 6.0+ with or without root, maps Frida RPC to Python and JSON-RPC calls, and includes an MCP server and a natural-language agent command.","description_zh":"采用客户端／服务器架构的 Android 自动化与动态分析平台，用于分析者有权测试的设备。设备端服务通过单一服务对外提供 UI 自动化、基于浏览器的远程桌面、HTTPS 流量抓取（MITM）和内置的 Frida 插桩，由包含 160 多个 API 的 Python 客户端库驱动。README 称其支持 Android 6.0+，可在有无 root 的情况下运行，将 Frida RPC 映射为 Python 与 JSON-RPC 调用，并内置 MCP 服务器和自然语言 agent 命令。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"open-oura-ring-protocol-case","name":"open_oura: a cloud-free Oura Ring client built on its reverse-engineered BLE protocol","name_zh":"open_oura：基于逆向 BLE 协议、无需云端的 Oura Ring 客户端","url":"https://github.com/Th0rgal/open_oura","evidence_url":"https://github.com/Th0rgal/open_oura/blob/e57c43ce5fe0cf9a646afa790bda3731be767507/README.md","description_en":"Reimplements the Bluetooth Low Energy protocol of the Oura Ring Gen 3/4/5 in Rust crates and an oura command-line client that pairs with, authenticates to and syncs a ring directly, with no Oura account or cloud service. The author reports recovering the GATT layout, packet framing and AES app-auth flow from the decompiled Android app, and porting history-event decoders and several on-device metrics, such as HRV, sleep debt and nightly temperature baselines, from Ghidra decompilations of the app's native libraries. Event bodies are stored raw in SQLite so they can be re-decoded as decoders improve.","description_zh":"用一组 Rust crate 和 oura 命令行客户端重新实现 Oura Ring 第 3/4/5 代的低功耗蓝牙协议，可直接与戒指配对、认证并同步数据，无需 Oura 账户或云服务。作者称从反编译的 Android 应用中恢复了 GATT 布局、数据包帧格式和基于 AES 的应用认证流程，并依据 Ghidra 对应用原生库的反编译结果，移植了历史事件解码器以及 HRV、睡眠负债、夜间体温基线等若干设备端指标算法。事件内容以原始形式存入 SQLite，解码器改进后可重新解码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-20"},{"id":"pe-sieve","name":"PE-sieve","name_zh":"PE-sieve 进程内存植入扫描工具","url":"https://github.com/hasherezade/pe-sieve","evidence_url":"https://github.com/hasherezade/pe-sieve/blob/98788a6ef98cd3c1a0ee481dc5a6847cb4f92432/README.md","description_en":"Windows process scanner by hasherezade that finds and dumps implants in one running process: replaced or injected PE modules, shellcode, inline and IAT hooks and other in-memory patches, with the README naming Process Hollowing, Process Doppelgänging and reflective DLL injection among the techniques it detects. Options add shellcode detection by patterns or statistics, scans of thread call stacks, non-executable pages and encrypted or obfuscated content, a choice of dump mode with import-table recovery for dumped PEs, minidumps and JSON reports. It builds as an EXE, as a DLL with a small API that Python, Go and Rust bindings use, or as a static library, and is the engine behind HollowsHunter and MalUnpack.","description_zh":"hasherezade 开发的 Windows 进程扫描工具，可在单个运行中的进程里发现并转储植入内容：被替换或注入的 PE 模块、shellcode、内联钩子与 IAT 钩子以及其他内存补丁；README 列出的可检测技术包括 Process Hollowing、Process Doppelgänging 和反射式 DLL 注入。可选功能包括按特征模式或统计方法检测 shellcode，扫描线程调用栈、不可执行内存页以及加密或混淆内容，选择转储模式并为转储的 PE 恢复导入表，生成 minidump 和 JSON 报告。它可构建为 EXE、提供简单 API 的 DLL（Python、Go 和 Rust 绑定均基于该 API）或静态库，也是 HollowsHunter 和 MalUnpack 的扫描引擎。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"oletools","name":"oletools","name_zh":"oletools Office 文档与 OLE 文件分析工具集","url":"https://github.com/decalage2/oletools","evidence_url":"https://github.com/decalage2/oletools/blob/ec10260989dbc48b9109e3d05d22beee19cf2333/README.md","description_en":"Python package by Philippe Lagadec for analyzing Microsoft OLE2 (Compound File Binary) files such as Office 97–2003 documents, MSI files and Outlook messages, as well as RTF and OpenXML documents, mainly for malware analysis, forensics and debugging. Its command-line tools detect and extract VBA and Excel 4 (XLM) macros, embedded OLE and Flash objects and DDE links (olevba, MacroRaptor, oleobj, rtfobj, pyxswf, msodde), flag characteristics common in malicious files with oleid and ftguess, and show directory entries, metadata, timestamps and sector maps with oledir, olemeta, oletimes and olemap. It is built on the same author's olefile parser.","description_zh":"Philippe Lagadec 开发的 Python 工具包，用于分析 Microsoft OLE2（复合文件二进制格式）文件，如 Office 97–2003 文档、MSI 文件和 Outlook 邮件，也支持 RTF 与 OpenXML 文档，主要面向恶意软件分析、取证和调试。其命令行工具可检测并提取 VBA 与 Excel 4（XLM）宏、嵌入的 OLE 和 Flash 对象以及 DDE 链接（olevba、MacroRaptor、oleobj、rtfobj、pyxswf、msodde），用 oleid 和 ftguess 标记恶意文件中常见的特征，并通过 oledir、olemeta、oletimes 和 olemap 查看目录项、元数据、时间戳和扇区布局。它基于同一作者的 olefile 解析器。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"binder-trace","name":"Binder Trace","name_zh":"Binder Trace Android Binder 消息拦截与解析工具","url":"https://github.com/foundryzero/binder-trace","evidence_url":"https://github.com/foundryzero/binder-trace/blob/a8a9a06fbf85dbf2241f9232c3776a515b05f8eb/README.md","description_en":"Frida-based terminal tool, described by its authors as \"Wireshark for Binder\", that intercepts the Binder IPC transactions an Android process sends and parses each message and its reply. Bundled structure files for specific Android releases map transaction codes back to AIDL interface and method names and decode parcel arguments into typed fields beside a hex dump. A frequency pane and a JSON filter file narrow the stream by interface, method or type, showing which system services an app calls and with what data.","description_zh":"基于 Frida 的终端工具，作者称其为“Binder 版 Wireshark”，用于拦截 Android 进程发出的 Binder IPC 事务，并解析每条消息及其回复。随附针对特定 Android 版本的结构文件，可把事务编号映射回 AIDL 接口和方法名，并把 parcel 参数解码为带类型的字段，与十六进制视图并列显示。频率面板和 JSON 过滤配置可按接口、方法或类型筛选消息流，从而看出应用调用了哪些系统服务、传递了什么数据。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-20"},{"id":"monkeydev","name":"MonkeyDev","name_zh":"MonkeyDev iOS 应用插桩开发工具包","url":"https://github.com/AloneMonkey/MonkeyDev","evidence_url":"https://github.com/AloneMonkey/MonkeyDev/blob/f906af1d90adc03bc6a6e4c1f39098a32371faae/README.md","description_en":"Based on iOSOpenDev, MonkeyDev adds a MonkeyApp project template to Xcode for instrumenting iOS apps the developer is authorized to analyze. From Xcode it injects a developer-written dylib into a supplied decrypted app, builds Objective-C or Logos (CaptainHook) hooks, and re-signs, installs and debugs the result with source-level breakpoints; optional build settings restore Objective-C symbols, export the target's Objective-C headers and enable Reveal view inspection. The current version also builds jailbreak Logos/CaptainHook tweaks and command-line tools for rootless, rootful or roothide environments.","description_zh":"MonkeyDev 基于 iOSOpenDev，为 Xcode 增加 MonkeyApp 工程模板，用于对开发者有权分析的 iOS 应用进行插桩。它在 Xcode 中将开发者编写的 dylib 注入到提供的已解密应用，编写 Objective-C 或 Logos（CaptainHook）Hook，并完成重签名、安装与带源码级断点的调试；可选的构建设置支持还原 Objective-C 符号、导出目标应用的 Objective-C 头文件以及启用 Reveal 视图检查。当前版本还可为 rootless、rootful 或 roothide 环境构建越狱 Logos/CaptainHook Tweak 和命令行工具。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"attify-firmware-analysis-toolkit","name":"Firmware Analysis Toolkit (FAT)","name_zh":"FAT 固件分析工具包","url":"https://github.com/attify/firmware-analysis-toolkit","evidence_url":"https://github.com/attify/firmware-analysis-toolkit/blob/54dd1a2a4705f2cafc14924497df6791813aab55/README.md","description_en":"Attify's firmware security toolkit, rewritten for version 2 as a Rust command-line tool built around per-image projects. It classifies unknown blobs and firmware images, extracts filesystems, inventories startup scripts, credential strings and crypto material, triages ELF binaries with radare2-based decompilation and source-to-sink taint, and inspects bare-metal MCU images, BMC flash, Edge AI model files and Android APKs. Projects can then go through preflight checks and QEMU emulation on native, FirmAE, Firmadyne or EMUX backends.","description_zh":"Attify 的固件安全研究工具包，第 2 版改写为以单个镜像项目为中心的 Rust 命令行工具。它可识别未知数据块和固件镜像、提取文件系统，梳理启动脚本、凭据字符串和密码学材料，借助基于 radare2 的反编译与源到汇的污点分析初筛 ELF 二进制，还能检查裸机 MCU 镜像、BMC 闪存、边缘 AI 模型文件和 Android APK。之后可对项目做运行前检查，并通过原生、FirmAE、Firmadyne 或 EMUX 后端进行 QEMU 仿真。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"quark-engine","name":"Quark-Engine","name_zh":"Quark-Engine Android 恶意软件分析引擎","url":"https://github.com/ev-flow/quark-engine","evidence_url":"https://github.com/ev-flow/quark-engine/blob/7accc95f104c6f30b8f64908ca022c30059121fd/README.md","description_en":"Rule-based engine for analysing suspicious Android apps: it loads an APK's Dalvik bytecode and checks JSON behaviour rules, each naming permissions and a pair of framework API calls, through five confidence stages, from the permission being requested and either API being called up to both calls appearing in order in one method and passing the same register. Weighted rule matches produce a threat score, with summary, detail, JSON, web, call-graph and label reports, and Quark Script exposes the analysis as a Python API that the project presents for finding vulnerabilities. The repository also ships two Claude Code skills, for running an analysis and generating a rule, and an optional LangChain agent that uses the OpenAI API.","description_zh":"基于规则分析可疑 Android 应用的引擎：载入 APK 的 Dalvik 字节码，用 JSON 行为规则逐条检查；每条规则列出若干权限和一对框架 API 调用，并按五个置信阶段判定，从申请了该权限、调用了其中一个 API，到两个调用在同一方法中按顺序出现并传递同一寄存器。加权后的规则命中结果给出威胁分数，并可输出摘要、详情、JSON、网页、调用图和标签报告；Quark Script 把这套分析以 Python API 形式提供，项目将其用于挖掘漏洞。仓库还附带两个 Claude Code 技能（分别用于运行分析和生成规则），以及一个可选的、调用 OpenAI API 的 LangChain 智能体。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"hollows-hunter","name":"Hollows Hunter","name_zh":"Hollows Hunter 进程内存植入扫描器","url":"https://github.com/hasherezade/hollows_hunter","evidence_url":"https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/README.md","description_en":"Windows command-line memory scanner by hasherezade that runs the PE-sieve engine across many processes, or the whole system, instead of a single PID. It recognizes and dumps replaced or implanted PE modules, shellcode, hooks and other in-memory patches for further analysis, selecting processes by PID list, name list or creation time relative to the scan. Scans can repeat in a loop or, in the 64-bit build, run as an ETW listener whose INI profile chooses the triggering events.","description_zh":"hasherezade 开发的 Windows 命令行内存扫描器，把 PE-sieve 引擎从单个 PID 扩展到多个进程乃至整个系统。它识别并转储被替换或植入的 PE 模块、shellcode、钩子及其他内存补丁，供进一步分析，可按 PID 列表、进程名列表或相对于扫描开始时间的进程创建时间选择目标。扫描可以循环执行；64 位版本还能作为 ETW 监听器运行，由 INI 配置文件选择触发扫描的事件。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"alphaseclab-awesome-reverse-engineering","name":"awesome-reverse-engineering (alphaSeclab)","name_zh":"awesome-reverse-engineering 全平台逆向资源清单（alphaSeclab）","url":"https://github.com/alphaSeclab/awesome-reverse-engineering","evidence_url":"https://github.com/alphaSeclab/awesome-reverse-engineering/blob/1a7445d2c7e3e42350a2556c70b469fb3429d49a/Readme_en.md","description_en":"Large reverse-engineering link list, auto-exported in 2019 in English and Chinese, with abridged and full README versions. The full English README lists about 3,600 open-source tools and 2,300 posts and videos, grouped under Windows, Linux, Apple platforms and Android, and under tool sections for IDA, Ghidra, x64dbg, OllyDbg, WinDbg, radare2, Cuckoo, Binary Ninja and dynamic binary instrumentation. Tool rows carry a star count, language and upstream description captured at export time.","description_zh":"规模很大的逆向工程链接清单，2019 年以中英文自动导出，分精简版和完整版 README。完整英文版列出约 3600 个开源工具和 2300 篇文章及视频，按 Windows、Linux、Apple 平台和 Android 分组，并为 IDA、Ghidra、x64dbg、OllyDbg、WinDbg、radare2、Cuckoo、Binary Ninja 及动态二进制插桩设有工具专区。工具条目附有导出时记录的 Star 数、编程语言和上游简介。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"restore-symbol","name":"restore-symbol","name_zh":"restore-symbol iOS 符号表恢复工具","url":"https://github.com/tobefuturer/restore-symbol","evidence_url":"https://github.com/tobefuturer/restore-symbol/blob/83ccb9085339750fd777b0707641b68c7661a388/README.md","description_en":"macOS command-line tool that writes a stripped iOS app's Mach-O executable back out with a rebuilt symbol table, so a debugger such as lldb can break on and display Objective-C method names. It recovers method names and addresses from the binary's Objective-C metadata through class-dump, and can merge extra name and address pairs from a JSON file, such as the block symbols found by the bundled IDA script.","description_zh":"运行于 macOS 的命令行工具，为已剥离符号的 iOS 应用 Mach-O 可执行文件重建符号表并输出新文件，使 lldb 等调试器能按 Objective-C 方法名设置断点并显示名称。它借助 class-dump 从二进制的 Objective-C 元数据中恢复方法名和地址，也可以从 JSON 文件合并额外的名称与地址，例如随附 IDA 脚本找到的 block 符号。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"awesome-mobile-security","name":"awesome-mobile-security","name_zh":"awesome-mobile-security 移动应用安全资源清单","url":"https://github.com/vaib25vicky/awesome-mobile-security","evidence_url":"https://github.com/vaib25vicky/awesome-mobile-security/blob/490ed366b448d4635a8263be62c51a92a619d060/README.md","description_en":"A single-README list of Android and iOS application security resources, about 245 links in all, divided by platform into blogs, papers and how-tos, books, courses, tools, deliberately vulnerable lab apps, talks and miscellany. Android tools are further split into static analysis, dynamic analysis and online APK analyzers, and reverse-engineering entries such as smali/baksmali, radare2, Cutter, Bytecode Viewer, Frida and Objection sit alongside pentesting guides and vulnerability write-ups.","description_zh":"以单个 README 维护的 Android 与 iOS 应用安全资源清单，共约 245 个链接，按平台分为博客、论文与教程、书籍、课程、工具、故意留有漏洞的练习应用、演讲及杂项。Android 工具又细分为静态分析、动态分析和在线 APK 分析服务；smali/baksmali、radare2、Cutter、Bytecode Viewer、Frida、Objection 等逆向工程条目与渗透测试指南和漏洞分析文章并列。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["app"],"verified_at":"2026-10-19"},{"id":"dexcalibur","name":"Dexcalibur (Reversense)","name_zh":"Dexcalibur（Reversense）Android 逆向分析平台","url":"https://github.com/reversenseorg/dexcalibur","evidence_url":"https://github.com/reversenseorg/dexcalibur/blob/2408f791ba869e7dba8f901332e44a5fee96a973/README.md","description_en":"Android reverse-engineering platform that combines static analysis with Frida-based dynamic instrumentation; the master branch is Reversense (Dexcalibur 2.0), a rewrite that runs as a Node.js web server for collaborative projects. Its README describes modeling an app's files, Smali and native code into one searchable representation with Radare2 integration, generating hooks for Java methods, Objective-C and native functions, and building dynamic cross-references from traces collected on attached devices. Inspector plugins in the repository observe areas such as permissions, cryptography, file-system, network and UI activity.","description_zh":"结合静态分析与基于 Frida 的动态插桩的 Android 逆向分析平台；master 分支是重写后的 Reversense（Dexcalibur 2.0），以 Node.js Web 服务形式运行，支持多人协作项目。README 介绍了如何把应用的文件、Smali 和原生代码建模为统一的可搜索表示（集成 Radare2），为 Java 方法、Objective-C 和原生函数生成钩子，并依据在已连接设备上采集的跟踪构建动态交叉引用。仓库中的 Inspector 插件分别观察权限、加密、文件系统、网络和界面等方面的活动。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"fakenet-ng","name":"FakeNet-NG","name_zh":"FakeNet-NG 动态网络分析工具","url":"https://github.com/mandiant/flare-fakenet-ng","evidence_url":"https://github.com/mandiant/flare-fakenet-ng/blob/7c8e006198b9df6e7b511140288fc5113c25d729/README.md","description_en":"Mandiant FLARE's dynamic network analysis tool for malware analysts, a successor to the original Fakenet. Its Diverter redirects traffic from local processes on Windows, or from other hosts in Linux MultiHost mode, to configurable listeners that simulate DNS, HTTP and HTTPS, SMTP, FTP, TFTP, IRC, POP and raw TCP or UDP services, with process and host filters, custom responses and an option to launch a command such as a debugger on a connection. Sessions can be saved as PCAP and end with an interactive HTML report of network-based indicators grouped by process and protocol.","description_zh":"Mandiant FLARE 团队面向恶意软件分析人员的动态网络分析工具，是原版 Fakenet 的后继。其 Diverter 将 Windows 本机进程的流量，或在 Linux MultiHost 模式下将其他主机的流量，重定向到可配置的监听器；这些监听器模拟 DNS、HTTP 与 HTTPS、SMTP、FTP、TFTP、IRC、POP 以及原始 TCP 或 UDP 服务，并支持进程和主机过滤、自定义响应，以及在连接到来时启动调试器等命令。会话可保存为 PCAP，结束时生成交互式 HTML 报告，按进程和协议归类展示网络行为指标。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary","protocol"],"verified_at":"2026-10-19"},{"id":"joern","name":"Joern","name_zh":"Joern 代码属性图分析平台","url":"https://github.com/joernio/joern","evidence_url":"https://github.com/joernio/joern/blob/7f886b32b02ec770668dbc79176273cb8c62e319/README.md","description_en":"Static code analysis platform that parses source code, JVM bytecode and executables into code property graphs held in a graph database and queried with a Scala-based language from an interactive shell or server mode. Frontends cover C/C++, Java, JavaScript, Python, Kotlin, PHP, Go, Ruby, Swift, C#, Rust and ABAP source, JVM bytecode and APK/DEX files through Soot, and binaries loaded through an embedded Ghidra, which the documentation lists as x86/x64 support. It adds a static taint-tracking engine, the joern-scan query database of vulnerability patterns, and export of AST, CFG, PDG or whole-graph views to DOT, GraphML, GraphSON or Neo4j CSV.","description_zh":"静态代码分析平台，将源代码、JVM 字节码和可执行文件解析为代码属性图并存入图数据库，可在交互式 shell 或服务器模式下用基于 Scala 的查询语言检索。前端覆盖 C/C++、Java、JavaScript、Python、Kotlin、PHP、Go、Ruby、Swift、C#、Rust 和 ABAP 源码，借助 Soot 处理 JVM 字节码及 APK/DEX 文件，并通过内置的 Ghidra 加载二进制文件，文档将这部分列为 x86/x64 支持。它还提供静态污点追踪引擎、收录漏洞模式的 joern-scan 查询库，并可将 AST、CFG、PDG 或整图导出为 DOT、GraphML、GraphSON 或 Neo4j CSV。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"reverser-ai","name":"ReverserAI","name_zh":"ReverserAI：本地大模型函数命名 Binary Ninja 插件","url":"https://github.com/mrphrazer/reverser_ai","evidence_url":"https://github.com/mrphrazer/reverser_ai/blob/1d572da70479ea822875b9350135d7e3402f5557/README.md","description_en":"Binary Ninja plugin that suggests function names from HLIL decompiler output with a language model run locally through llama.cpp; the README says it operates entirely offline once the model is downloaded. It can rename the current function, every function still carrying a default sub_ name in call-graph post-order, or only those referencing strings and imported or library symbols. The author presents it as a research proof of concept whose only implemented task is function naming.","description_zh":"Binary Ninja 插件，借助 llama.cpp 在本机运行语言模型，依据 HLIL 反编译输出建议函数名；README 称下载模型后即可完全离线运行。它可以重命名当前函数，按调用图后序遍历重命名所有仍沿用默认 sub_ 名称的函数，或只处理其中引用字符串、导入符号或库符号的函数。作者把它定位为研究性概念验证，目前唯一实现的任务是函数命名。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-20"},{"id":"speakeasy","name":"Speakeasy","name_zh":"Speakeasy Windows 恶意软件仿真框架","url":"https://github.com/mandiant/speakeasy","evidence_url":"https://github.com/mandiant/speakeasy/blob/aa9f22643f4519e0555141cd16ee25eb971b5518/README.md","description_en":"Mandiant's Windows malware emulation framework, which runs PE executables, DLLs, kernel drivers and raw x86/amd64 shellcode on the Unicorn CPU emulator inside a modeled Windows runtime instead of a full VM. Hand-written handlers and a signature database built from win32metadata and phnt emulate Windows API calls, process and thread behavior, the filesystem, registry and network, and each run is recorded as a structured JSON report of API events with named arguments, dropped files and optional memory snapshots. It runs from the speakeasy CLI or as a Python library, and a built-in GDB stub lets an analyst step through an emulated sample.","description_zh":"Mandiant 的 Windows 恶意软件仿真框架，借助 Unicorn CPU 仿真器，在模拟的 Windows 运行环境（而非完整虚拟机）中运行 PE 可执行文件、DLL、内核驱动和原始 x86/amd64 shellcode。手写的处理程序加上由 win32metadata 和 phnt 生成的签名库，负责模拟 Windows API 调用、进程与线程行为、文件系统、注册表和网络，每次运行都记录为结构化 JSON 报告，其中包含带参数名的 API 事件、释放的文件以及可选的内存快照。它可通过 speakeasy 命令行或作为 Python 库使用，内置的 GDB 桩可让分析者单步调试仿真中的样本。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"ios-app-reverse-engineering-book","name":"iOS App Reverse Engineering","name_zh":"《iOS 应用逆向工程》英文版","url":"https://github.com/iosre/iOSAppReverseEngineering","evidence_url":"https://github.com/iosre/iOSAppReverseEngineering/blob/a09c2cff202e1b1640c7f7ff8069693b709244a8/README.md","description_en":"Freely published 2015 book by snakeninny and hangcom on reverse engineering iOS apps, distributed in its repository as a 442-page English PDF. Its four parts cover the iOS filesystem and file types; OS X and on-device tools such as class-dump, Theos, Reveal, IDA, Cycript and LLDB with debugserver; an Objective-C and ARM assembly methodology for locating the code behind a feature; and four worked practices that locate the relevant code in Notes, Mail, WeChat and Messages and then extend those apps with tweaks.","description_zh":"snakeninny 与 hangcom 于 2015 年免费公开的 iOS 应用逆向工程图书，仓库中以 442 页英文 PDF 形式发布。全书分为四部分：iOS 文件系统与文件类型；class-dump、Theos、Reveal、IDA、Cycript 以及 LLDB 与 debugserver 等 OS X 端和设备端工具；基于 Objective-C 与 ARM 汇编、定位功能背后代码的方法论；以及四个实践案例，先在备忘录、邮件、微信和信息应用中定位相关代码，再编写插件（tweak）为这些应用增加功能。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app"],"verified_at":"2026-10-20"},{"id":"lazyida","name":"LazyIDA","name_zh":"LazyIDA：IDA 便捷操作插件","url":"https://github.com/L4ys/LazyIDA","evidence_url":"https://github.com/L4ys/LazyIDA/blob/0ecdf8d62554405fecdd000c750644499f4eccc0/README.md","description_en":"Single-file IDA plugin of convenience actions first written for CTF work. In the disassembly and hex views it dumps a selection as a string, hex string, C/C++ array or Python list of bytes, words, dwords or qwords and copies the result to the clipboard, shows a selection XORed with one byte, fills it with NOPs, and copies or jumps to addresses and file offsets by hotkey. With Hex-Rays it toggles a function’s return type to void, copies item names and jumps to the member function behind an obj->func call on double-click, while a heuristic scan lists printf-family calls whose format argument is not a read-only constant.","description_zh":"最初为 CTF 解题编写的单文件 IDA 便捷操作插件。在反汇编和十六进制视图中，它可把选区导出为字符串、十六进制字符串，或按字节、字、双字、四字导出为 C/C++ 数组或 Python 列表，并复制到剪贴板；还能显示选区与单个字节异或后的结果、用 NOP 填充选区，并通过快捷键复制或跳转到地址和文件偏移。配合 Hex-Rays 时，它可把函数返回类型切换为 void、复制条目名称，双击 obj->func 形式的调用时跳转到对应成员函数；另有启发式扫描，列出格式参数并非只读常量的 printf 系列调用。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"tiny-tracer","name":"Tiny Tracer","name_zh":"Tiny Tracer API 调用跟踪工具","url":"https://github.com/hasherezade/tiny_tracer","evidence_url":"https://github.com/hasherezade/tiny_tracer/blob/99618fc0569a4a06b7955e507e1707792ad1bef5/README.md","description_en":"Intel Pin tool by hasherezade that traces a 32- or 64-bit program while it runs on Windows or Linux, logging API calls (with arguments and return values for watched functions), chosen local and statically linked functions, inline system calls, RDTSC, CPUID and INT instructions, and transitions between sections of the traced module, which helps find the original entry point of a packed module. It can follow code the module unpacks into new memory, disassemble selected ranges and, on Windows, flag the anti-debug and anti-VM checks a sample performs. Each run writes a .tag file of RVA;event lines that PE-bear reads natively and that the wiki shows loading into IDA Pro, Binary Ninja, x64dbg, Ghidra and Cutter to annotate code.","description_zh":"hasherezade 开发的 Intel Pin 插桩工具，在 Windows 或 Linux 上跟踪运行中的 32 位或 64 位程序，记录 API 调用（对监视的函数还会记录参数和返回值）、指定的本地函数和静态链接库函数、内联系统调用、RDTSC、CPUID 和 INT 指令，以及被跟踪模块各节区之间的跳转，有助于找到加壳模块的原始入口点。它可以继续跟踪模块解包到新内存中的代码，对选定范围进行反汇编，并可在 Windows 上标记样本执行的反调试和反虚拟机检查。每次运行都会生成由“RVA;事件”行组成的 .tag 文件，PE-bear 可直接读取，Wiki 还演示了将其导入 IDA Pro、Binary Ninja、x64dbg、Ghidra 和 Cutter 以标注代码。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"vdexextractor","name":"vdexExtractor","name_zh":"vdexExtractor Vdex 字节码提取工具","url":"https://github.com/anestisb/vdexExtractor","evidence_url":"https://github.com/anestisb/vdexExtractor/blob/78f283b60ab6991fa27eeaff7d7be16409401c08/README.md","description_en":"Command-line C tool that extracts the Dex bytecode held in the Vdex containers that ART's dex2oat compiler writes beside Oat files since Android 8.0 (API 26), and by default reverts ART's dex-to-dex quickening so the output is ordinary Dex again. It can also dump the verified-dependency records stored in a Vdex file, disassemble the bytecode in a dexdump-like format and report the Android API level of a Vdex version. Android 9 and 10 Vdex files hold CompactDex, which the bundled deodex helper converts back to standard Dex through a separately built compact_dex_converter.","description_zh":"C 语言命令行工具，用于从 ART 的 dex2oat 编译器自 Android 8.0（API 26）起在 Oat 文件旁生成的 Vdex 容器中提取 Dex 字节码，并默认撤销 ART 的 dex-to-dex quickening 优化，使输出重新成为普通 Dex。它还能转储 Vdex 文件中保存的验证依赖记录，以类似 dexdump 的格式反汇编字节码，并报告某个 Vdex 版本对应的 Android API 级别。Android 9 和 10 的 Vdex 文件存放的是 CompactDex，随附的 deodex 辅助脚本会借助单独构建的 compact_dex_converter 将其转换回标准 Dex。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"ponce","name":"Ponce","name_zh":"Ponce IDA 符号执行与污点分析插件","url":"https://github.com/illera88/Ponce","evidence_url":"https://github.com/illera88/Ponce/blob/68586760feaf86f719d85fe08fd55cd22f29f9a3/README.md","description_en":"IDA Pro plugin, described by its repository as the winner of the 2016 IDA plugin contest, that brings the Triton framework's taint analysis and symbolic execution into IDA's debugger for x86 and x64 programs. After the analyst taints or symbolizes registers, memory or inputs such as argv or a buffer read with fread, Ponce single-steps the debugged program, analyzes each instruction with Triton and renames the functions that the input influences. Its symbolic engine can solve a branch condition, or negate it and inject a satisfying input into memory, while execution snapshots restore earlier state to try that input; builds with Hex-Rays support also show the results in decompiler pseudocode.","description_zh":"IDA Pro 插件，仓库简介称其获得 2016 年 IDA 插件大赛冠军，它把 Triton 框架的污点分析和符号执行引入 IDA 调试器，适用于 x86 和 x64 程序。分析人员对寄存器、内存或 argv、fread 读入的缓冲区等输入进行污点标记或符号化后，Ponce 会单步执行被调试程序，用 Triton 分析每条指令，并重命名受该输入影响的函数。其符号引擎可以求解分支条件，或将条件取反后把满足条件的输入注入内存，再借助执行快照恢复先前状态来尝试该输入；启用 Hex-Rays 支持的构建还会在反编译伪代码中显示分析结果。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"can-commander","name":"CAN Commander","name_zh":"CAN Commander CAN 总线逆向工具","url":"https://github.com/MatthewKuKanich/CAN_Commander","evidence_url":"https://github.com/MatthewKuKanich/CAN_Commander/blob/6079fe05d5a340b445317e89998d78b390e90a62/README.md","description_en":"A Flipper Zero app and earlier Arduino sketches for reverse engineering CAN bus traffic, chiefly in vehicles. The current app is a UART front end for a CAN Commander ESP32 board: it streams all or filtered frames, lists unique IDs, measures message rates, tracks per-bit and per-byte changes, and runs a two-phase Auto Reverse Engineer that first calibrates out background traffic and then shows which IDs change during an action. It also decodes live signals from DBC-based profiles and reads OBD-II PIDs, the VIN and trouble codes.","description_zh":"用于逆向 CAN 总线流量（主要是车辆总线）的 Flipper Zero 应用及早期 Arduino 程序。当前应用通过 UART 为 CAN Commander ESP32 板提供操作界面：可显示全部或过滤后的帧、列出唯一 ID、测量报文速率、跟踪逐位和逐字节变化，并提供两阶段的自动逆向功能，先校准排除背景流量，再显示执行某个操作时哪些 ID 发生变化。它还能依据基于 DBC 的配置解码实时信号，并读取 OBD-II PID、VIN 和故障码。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"frida-snippets","name":"Frida Snippets","name_zh":"Frida Snippets Frida 插桩示例集","url":"https://github.com/iddoeldor/frida-snippets","evidence_url":"https://github.com/iddoeldor/frida-snippets/blob/773f89ce8fcd32b0c2e843d148436d6556e064e9/README.md","description_en":"A single large README that collects hand-written Frida instrumentation examples, grouped into Native, Android and iOS sections, for observing how a running app behaves. The examples show patterns such as attaching interceptors, enumerating loaded modules and classes, describing class members, tracing method arguments and return values, printing backtraces, logging SQLite queries and I/O, and scanning or dumping process memory. A scripts directory adds helper code, including Python generators that emit hook stubs from a decompiler and a frida-server install script, plus editor snippets for Sublime and Vim.","description_zh":"一个较大的 README，汇集手写的 Frida 动态插桩示例，按 Native、Android 和 iOS 分组，用于观察运行中应用的行为。示例展示了诸如挂接 Interceptor、枚举已加载模块与类、描述类成员、跟踪方法参数与返回值、打印调用栈、记录 SQLite 查询与 I/O，以及扫描或转储进程内存等模式。scripts 目录附带辅助代码，包括从反编译器生成钩子代码片段的 Python 脚本和 frida-server 安装脚本，以及用于 Sublime 和 Vim 的编辑器片段。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app"],"verified_at":"2026-10-20"},{"id":"sony-headphones-client-case","name":"Sony Headphones Client: a desktop client for Sony’s headset control protocol","name_zh":"Sony Headphones Client：Sony 耳机控制协议的桌面客户端","url":"https://github.com/Plutoberth/SonyHeadphonesClient","evidence_url":"https://github.com/Plutoberth/SonyHeadphonesClient/blob/5620e8ed5deccb957338b54e371b215146080819/README.md","description_en":"Recreates part of Sony’s mobile-only Headphones app as a Windows, Linux and macOS desktop client that changes noise-cancelling, ambient-sound and virtual-sound settings over a Bluetooth RFCOMM connection to a paired headset. The author reports reverse engineering the phone app to define its control protocol, and the code rebuilds its message framing, with start and end markers, byte escaping, sequence numbers, a sum checksum and acknowledgements, together with the two set-parameter commands the client sends. Full support is reported for few models, mainly the WH-1000XM3, and the project is archived.","description_zh":"把 Sony 仅限手机的 Headphones 应用的部分功能重建为 Windows、Linux 和 macOS 桌面客户端，通过蓝牙 RFCOMM 连接已配对的耳机，调整降噪、环境声和虚拟音效设置。作者称通过逆向手机应用定义了其控制协议；代码重建了报文封装，包括起止标记、字节转义、序列号、求和校验和确认应答，以及客户端发送的两条参数设置命令。据报告只有少数型号完全可用，主要是 WH-1000XM3，项目现已归档。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-20"},{"id":"garlic-decompiler","name":"Garlic","name_zh":"Garlic APK/Java 反编译器","url":"https://github.com/neocanable/garlic","evidence_url":"https://github.com/neocanable/garlic/blob/700a7f4ea650f5ba5162604987f5a414a2e27026/README.md","description_en":"Java and Android decompiler written in C that recovers Java source from class, JAR, WAR, DEX and APK files on multiple threads; it also prints javap- or dexdump-style class listings, converts APK and DEX files to smali, searches their strings with regular expressions and generates call graphs for DEX and APK files. Running garlic -m starts a stdio MCP server whose seven tools decompile files, dump class information, build call graphs, load them into DuckDB for SQL queries and read the extracted AndroidManifest.xml. The README reports decompiling an APK of more than 200 MB with about 190,000 classes in 12 seconds.","description_zh":"用 C 语言编写的 Java 与 Android 反编译器，可多线程地从 class、JAR、WAR、DEX 和 APK 文件还原 Java 源码；还能输出类似 javap 或 dexdump 的类信息，将 APK 和 DEX 转换为 smali，用正则表达式搜索其中的字符串，并为 DEX 和 APK 生成调用图。运行 garlic -m 会启动基于 stdio 的 MCP 服务器，提供七个工具，可反编译文件、输出类信息、构建调用图、将调用图导入 DuckDB 以便用 SQL 查询，以及读取提取出的 AndroidManifest.xml。README 称反编译一个超过 200 MB、约 19 万个类的 APK 只需 12 秒。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"drakvuf-sandbox","name":"DRAKVUF Sandbox","name_zh":"DRAKVUF Sandbox 虚拟机监控器级恶意软件分析沙箱","url":"https://github.com/CERT-Polska/drakvuf-sandbox","evidence_url":"https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/README.md","description_en":"CERT Polska’s automated black-box malware analysis system built on the DRAKVUF engine, which observes a Windows guest from the Xen hypervisor through virtual machine introspection rather than an agent installed in the guest. Samples submitted through the web interface or the CLI run in a restored snapshot, and the report covers the process tree, WinAPI, file and network activity, a PCAP, intercepted TLS keys, memory dumps, screenshots and capa-based TTP indicators. A drakrun installer builds the Windows guest, its snapshot and the VMI profile.","description_zh":"CERT Polska 基于 DRAKVUF 引擎构建的自动化黑盒恶意软件分析系统，借助虚拟机自省从 Xen 虚拟机监控器一侧观察 Windows 客户机，无需在客户机中安装代理。通过 Web 界面或命令行提交的样本在恢复的快照中运行，报告涵盖进程树、WinAPI、文件与网络活动、PCAP、截获的 TLS 密钥、内存转储、截图以及基于 capa 的 TTP 指标。drakrun 安装命令负责构建 Windows 客户机、快照及 VMI 配置文件。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"hexrayspytools","name":"HexRaysPyTools","name_zh":"HexRaysPyTools 结构体重建插件","url":"https://github.com/igogo-x86/HexRaysPyTools","evidence_url":"https://github.com/igogo-x86/HexRaysPyTools/blob/b8ebf757a92fda934c35c418fc55bfdd6fc8e67c/readme.md","description_en":"IDAPython plugin for IDA Pro's Hex-Rays decompiler that helps rebuild structures and classes from pseudocode. Its structure builder collects the fields a variable accesses within one function or, with deep scan, across the functions it is passed to, marks virtual tables, resolves conflicting fields and finalizes a C declaration applied to every scanned variable; a Classes view edits classes and their virtual functions, and a graph shows how local types relate. Pseudocode helpers recast and rename across assignments and calls, propagate names, rewrite out-of-bounds pointers as CONTAINING_RECORD for a containing structure, edit function signatures, rename functions from assert strings and untangle if statements.","description_zh":"面向 IDA Pro Hex-Rays 反编译器的 IDAPython 插件，帮助根据伪代码重建结构体和类。其结构体构建器可在单个函数内，或通过深度扫描在变量被传入的各个函数中，收集该变量访问的字段，识别虚表，解决字段冲突，并生成 C 声明应用到所有已扫描的变量；Classes 视图可编辑类及其虚函数，结构图则展示本地类型之间的关系。伪代码辅助功能可沿赋值和调用两侧统一类型与名称、传播名称、将越界指针改写为包含结构体的 CONTAINING_RECORD、修改函数签名、根据 assert 字符串批量重命名函数，以及整理 if 语句。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"can-reverse-engineering","name":"Automated CAN Payload Reverse Engineering","name_zh":"CAN 负载自动逆向分析流水线","url":"https://github.com/brent-stone/CAN_Reverse_Engineering","evidence_url":"https://github.com/brent-stone/CAN_Reverse_Engineering/blob/096dfe828a54964a10d2967fc65bf7c6537761a0/README.md","description_en":"Research Python and R scripts that automate reverse engineering of Controller Area Network (CAN) payloads recorded from passenger vehicles, implementing the pipeline from Brent Stone's AFIT dissertation. The Python pipeline pre-processes a CAN log into per-arbitration-ID data frames, pulls out public SAE J1979 diagnostic data, runs a lexical analysis that guesses individual signal time-series boundaries, then a semantic analysis that builds a correlation matrix and hierarchically clusters related signals, with plots and a dendrogram as output. A separate R script set applies the rEDM empirical dynamic modeling package to engine-RPM, brake-pressure and vehicle-speed time series to study causal relationships.","description_zh":"一组研究用途的 Python 和 R 脚本，用于自动逆向分析从乘用车采集的控制器局域网（CAN）报文负载，实现了 Brent Stone 在 AFIT 的博士论文所述的流水线。Python 流水线先把 CAN 日志预处理为按仲裁 ID 组织的数据框，提取公开的 SAE J1979 诊断数据，再通过词法分析推测各信号时间序列的边界，随后通过语义分析构建相关性矩阵并对相关信号做层次聚类，输出图表和树状聚类图。另一组 R 脚本调用 rEDM 经验动力学建模包，对发动机转速、刹车压力和车速时间序列分析因果关系。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-20"},{"id":"capev2","name":"CAPE Sandbox (CAPEv2)","name_zh":"CAPEv2 恶意软件沙箱","url":"https://github.com/kevoreilly/CAPEv2","evidence_url":"https://github.com/kevoreilly/CAPEv2/blob/38c34af1aaeda512ea21ee834d19818a08a85d08/README.md","description_en":"Malware sandbox derived from Cuckoo v1 that runs samples in isolated Windows guests and records API-hook behavior, created and modified files, network traffic as PCAP, screenshots and memory dumps. Its capemon monitor adds automated unpacking, capturing injected, extracted or decompressed payloads and dumping process images, plus a debugger that YARA signatures or submission options can program with breakpoints and short instruction traces. Results are classified with YARA, Suricata and behavioral signatures, and malware configurations are extracted by parsers maintained in the separate CAPE-parsers package.","description_zh":"源自 Cuckoo v1 的恶意软件沙箱，在隔离的 Windows 客户机中运行样本，记录 API 挂钩行为、创建和修改的文件、PCAP 网络流量、屏幕截图和内存转储。其 capemon 监控组件增加了自动脱壳功能，可捕获被注入、解出或解压的载荷并转储进程映像；内置调试器可由 YARA 签名或提交选项设置断点并输出简短的指令跟踪。结果通过 YARA、Suricata 和行为签名分类，恶意软件配置则由独立的 CAPE-parsers 包中的解析器提取。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"luadec","name":"LuaDec","name_zh":"LuaDec：Lua 字节码反编译器","url":"https://github.com/viruscamp/luadec","evidence_url":"https://github.com/viruscamp/luadec/blob/895d92313fabaee260121c758c8320d1b21dd741/ReadMe.md","description_en":"Lua bytecode decompiler that turns compiled chunks back into Lua source, with a disassembly mode, selection of single nested functions by number and a guesser for local variable declarations that can be overridden by hand. Its -fc option recompiles each decompiled function and compares it instruction by instruction with the original. It targets Lua 5.1, marks Lua 5.2 and 5.3 support as experimental, and continues Hisham Muhammad’s LuaDec for Lua 5.0 and Zsolt Sztupak’s LuaDec51.","description_zh":"Lua 字节码反编译器，可把编译后的代码块还原为 Lua 源码，提供反汇编模式，可按编号只处理某个嵌套函数，并能推测局部变量声明，推测结果也可手动指定。其 -fc 选项会重新编译每个反编译出的函数，并与原函数逐条指令比较。它以 Lua 5.1 为主要目标，Lua 5.2 和 5.3 的支持标为实验性，延续了 Hisham Muhammad 面向 Lua 5.0 的 LuaDec 和 Zsolt Sztupak 的 LuaDec51。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-20"},{"id":"xpcspy","name":"xpcspy","name_zh":"xpcspy XPC 消息拦截工具","url":"https://github.com/ab-rizk/xpcspy","evidence_url":"https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/README.md","description_en":"Frida-powered command-line tool that observes XPC messages exchanged between processes on iOS and macOS in both directions, for understanding how Apple-platform apps and services talk over XPC. It can spawn or attach to a target over a USB or remote Frida connection, filter the trace by direction (incoming or outgoing) and by service name with wildcards, and optionally parse the binary-plist payloads carried in XPC dictionaries, with bplist00 and bplist16 described as officially supported and bplist15 and bplist17 as experimental. A Python CLI drives a TypeScript Frida agent that is compiled to JavaScript.","description_zh":"基于 Frida 的命令行工具，可双向观察 iOS 和 macOS 上进程之间交换的 XPC 消息，用于理解 Apple 平台的应用与服务如何通过 XPC 通信。它可通过 USB 或远程 Frida 连接启动或附加到目标，按方向（传入或传出）和带通配符的服务名过滤跟踪，并可选解析 XPC 字典中携带的二进制 plist 负载，其中 bplist00 和 bplist16 被列为正式支持，bplist15 和 bplist17 为实验性。工具由 Python 命令行驱动一个编译为 JavaScript 的 TypeScript Frida 代理。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-20"},{"id":"de4py","name":"de4py","name_zh":"de4py Python 反混淆与分析工具包","url":"https://github.com/Fadi002/de4py","evidence_url":"https://github.com/Fadi002/de4py/blob/0f66191b514e8c5a4de82aef7b01704385066629/README.md","description_en":"Python deobfuscation and analysis toolkit with a PySide6 GUI and a CLI mode, aimed at analysts examining obfuscated or packed Python programs. It bundles deobfuscators for named Python obfuscators such as Jawbreaker, BlankOBF, PlusOBF, Wodx, Hyperion and pyobfuscate, and an AI-assisted \"Onyx\" engine that pairs a local Ollama LLM (default qwen2.5-coder:1.5b) with AST cleaning and pattern matching. A file analyzer detects packers such as PyInstaller, computes hashes, looks up suspicious strings and extracts metadata, while a behavior monitor and a Python-code execution shell support dynamic inspection of a target process. It has a plugin API and can be used as a library.","description_zh":"带 PySide6 图形界面和命令行模式的 Python 反混淆与分析工具包，面向分析被混淆或打包的 Python 程序的人员。它内置针对多种 Python 混淆器（如 Jawbreaker、BlankOBF、PlusOBF、Wodx、Hyperion 和 pyobfuscate）的反混淆器，以及一个 AI 辅助的 \"Onyx\" 引擎，将本地 Ollama 大模型（默认 qwen2.5-coder:1.5b）与 AST 清理和模式匹配结合。文件分析器可检测 PyInstaller 等打包器、计算哈希、查找可疑字符串并提取元数据；行为监视器和一个执行 Python 代码的交互壳则用于对目标进程做动态检查。它提供插件 API，也可作为库使用。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"fujihack","name":"FujiHack","name_zh":"FujiHack：Fujifilm 相机固件逆向研究项目","url":"https://github.com/fujihack/fujihack","evidence_url":"https://github.com/fujihack/fujihack/blob/754acff9aa0322df19446cf7eca699b221c3330d/README.md","description_en":"Research codebase for reverse engineering Fujifilm cameras so that custom code can run on them under a patched firmware. It holds ARM firmware patches, chiefly a PTP/USB debugger that adds memory read, write and execute commands, a host CLI that uploads code and dumps memory over USB, and C headers documenting Fujifilm’s RTOS API with per-model firmware addresses and function stubs. On-camera code adds POSIX, graphics and I/O wrappers over that RTOS, a video record-limit mod, button remapping and the Frontier UI and module system.","description_zh":"以逆向 Fujifilm 相机为目标的研究代码库，使自定义代码能够在打过补丁的固件下于相机上运行。其中包括 ARM 固件补丁，最主要的是为 PTP/USB 增加内存读、写和执行命令的调试器补丁；一个通过 USB 上传代码并转储内存的主机命令行工具；以及记录 Fujifilm RTOS API 的 C 头文件，附各机型的固件地址和函数桩。相机端代码在该 RTOS 之上提供 POSIX、图形和 I/O 封装，并包含解除录像时长限制的修改、按键重映射，以及名为 Frontier 的界面与模块系统。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-20"},{"id":"efiseek","name":"efiSeek","name_zh":"efiSeek UEFI 模块 Ghidra 分析器","url":"https://github.com/DSecurity/efiSeek","evidence_url":"https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/README.md","description_en":"Ghidra analyzer extension from Digital Security for individual UEFI modules, enabled by default during auto-analysis of x86 and x64 PE images with an EFI subsystem. It labels known GUIDs from a bundled database, applies UEFI types from bundled data-type archives, passes the image handle and system table from the entry point into called functions, and marks protocols located with LocateProtocol or installed with InstallProtocolInterface, protocol-notify callbacks and SMI handlers registered for software, hardware and child interrupts. Findings are also kept as JSON in the program, which a headless-mode script uses to sort SMM modules into project folders by handler type.","description_zh":"Digital Security 开发的 Ghidra 分析器扩展，面向单个 UEFI 模块，在自动分析带 EFI 子系统的 x86 和 x64 PE 映像时默认启用。它依据自带的数据库标注已知 GUID，从自带的数据类型归档应用 UEFI 类型，把入口点的映像句柄和系统表参数传递到被调用的函数中，并标记通过 LocateProtocol 定位或通过 InstallProtocolInterface 安装的协议、协议通知回调，以及为软件、硬件和子中断注册的 SMI 处理函数。分析结果还以 JSON 形式保存在程序中，无界面模式脚本据此按处理函数类型把 SMM 模块分到不同的项目文件夹。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-20"},{"id":"dwarf-debugger","name":"Dwarf","name_zh":"Dwarf 基于 Frida 的多平台调试器","url":"https://github.com/iGio90/Dwarf","evidence_url":"https://github.com/iGio90/Dwarf/blob/fd859aeeb9fd14d97db1d95a194eb632ae109a46/README.md","description_en":"PyQt5 debugger built on Frida that attaches to or spawns processes on Android and iOS devices, the local machine or a remote Frida server. A session offers breakpoints, watchpoints, register context, backtraces and threads, a Capstone disassembly view for x86, x64, ARM and ARM64, a hex editor and panels for modules, memory ranges and memory search, while Java explorer, inspector and trace panels and an Objective-C inspector cover mobile app runtimes. User Frida scripts and Python plugins extend a session, and companion commands trace Java methods or native addresses (dwarf-trace), log syscalls from one module on arm64 (dwarf-strace) and scaffold scripting projects with Dwarf API typings (dwarf-creator).","description_zh":"基于 Frida 构建的 PyQt5 调试器，可附加或启动 Android、iOS 设备、本机或远程 Frida 服务器上的进程。调试会话提供断点、观察点、寄存器上下文、调用栈和线程视图，支持 x86、x64、ARM 与 ARM64 的 Capstone 反汇编视图、十六进制编辑器，以及模块、内存区域和内存搜索面板；Java 浏览、检查与跟踪面板和 Objective-C 检查器则面向移动应用运行时。用户编写的 Frida 脚本和 Python 插件可扩展会话，配套命令可跟踪 Java 方法或原生地址（dwarf-trace）、在 arm64 上记录单个模块发起的系统调用（dwarf-strace），并生成带 Dwarf API 类型声明的脚本项目（dwarf-creator）。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"fwanalyzer","name":"FwAnalyzer","name_zh":"FwAnalyzer 固件文件系统规则检查工具","url":"https://github.com/cruise-automation/fwanalyzer","evidence_url":"https://github.com/cruise-automation/fwanalyzer/blob/a0db45054642f89a5f855b0dcc0730ebd01c8c9e/Readme.md","description_en":"Rule-based checker for filesystem images taken from firmware: it reads ext2/3/4, FAT/VFAT, SquashFS and UBIFS images, cpio archives or a directory, and writes a JSON report of every file that breaks the rules in a TOML configuration. Rules cover SUID and world-writable files, allowed owners, SELinux labels and Linux capabilities, per-file metadata, content regexes, SHA-256 digests, JSON fields and external scripts such as the bundled checksec wrapper; it can also extract values such as version strings and compare the file tree or selected files with a previous run. Cruise describes it as part of a firmware security check suite, and check.py with an Android OTA unpacker runs it over each image in a firmware package.","description_zh":"针对固件中文件系统镜像的规则检查工具：读取 ext2/3/4、FAT/VFAT、SquashFS 和 UBIFS 镜像、cpio 归档或目录，并以 JSON 报告列出所有违反 TOML 配置规则的文件。规则涵盖 SUID 与全局可写文件、允许的属主、SELinux 标签与 Linux capabilities、单个文件的元数据、内容正则、SHA-256 摘要、JSON 字段，以及外部脚本（例如附带的 checksec 包装脚本）；还能提取版本字符串等数值，并把文件树或指定文件与上一次运行的结果比较。Cruise 将其定位为固件安全检查流程的一环，check.py 搭配 Android OTA 解包脚本可对固件包中的每个镜像逐一运行检查。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-20"},{"id":"wpegpt","name":"WPeGPT","name_zh":"WPeGPT IDA AI 分析插件","url":"https://github.com/WPeace-HcH/WPeGPT","evidence_url":"https://github.com/WPeace-HcH/WPeGPT/blob/8a7802aef9ba980dcb5d2a6a24c6ef19b06ae641/README.md","description_en":"IDA plugin, formerly WPeChatGPT and inspired by Gepetto, that sends the Hex-Rays pseudocode of a function to an OpenAI-compatible model (OpenAI, DeepSeek or another compatible endpoint) and writes the model's analysis back into IDA as comments. Interactive actions explain a function's purpose and behavior, suggest variable names, re-express small routines such as XOR decoding in Python and flag potential vulnerabilities. Version 3.0 adds WPeServer, a TCP command server inside IDA through which an external controller or the separate wpegpt-analyzer skill runs headless light, full or vulnerability-focused passes, with string classification, network-indicator extraction, function suspiciousness scoring and JSON plus Markdown reports.","description_zh":"IDA 插件，前身为 WPeChatGPT，受 Gepetto 启发：把函数的 Hex-Rays 伪代码发送给兼容 OpenAI 接口的模型（OpenAI、DeepSeek 或其他兼容端点），再将模型的分析结果以注释形式写回 IDA。交互功能可说明函数的用途与行为、建议变量名、用 Python 重写 XOR 解码等小型例程，并标记潜在漏洞。3.0 版新增 WPeServer，即运行在 IDA 内的 TCP 命令服务器，外部控制器或独立的 wpegpt-analyzer 技能可借此以无界面方式执行 light、full 或侧重漏洞的分析流程，提供字符串分类、网络指标提取、函数可疑度评分，并输出 JSON 与 Markdown 报告。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-20"},{"id":"kpwn-iosre","name":"iOSRE: iOS Reverse Engineering reference","name_zh":"iOSRE：iOS 逆向工程参考资料","url":"https://github.com/kpwn/iOSRE","evidence_url":"https://github.com/kpwn/iOSRE/blob/20aff7761b249cb2f76477ef39f8885bfcb404cf/README.md","description_en":"A community-maintained reference on iOS reverse engineering started by kpwn, built from a wiki, a curated index of public technical papers and talks, and a few environment-setup scripts. The wiki pages introduce iOS internals such as the Mach-O executable format, the XNU kernel and IOKit, the boot chain and a history of platform mitigations, while the README states the project is an early, ongoing effort and several pages remain stubs. The repository hosts notes and external links rather than any Apple firmware, device images or app binaries.","description_zh":"由 kpwn 发起、社区维护的 iOS 逆向工程参考资料，由一个 wiki、一份公开技术论文与演讲的整理索引，以及几个环境配置脚本组成。wiki 页面介绍 iOS 的底层机制，如 Mach-O 可执行文件格式、XNU 内核与 IOKit、启动链，以及平台缓解措施的历史；README 说明项目尚处早期、仍在持续完善，多个页面仍是占位草稿。仓库只收录笔记和外部链接，并不包含任何 Apple 固件、设备镜像或应用二进制文件。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app","binary","firmware"],"verified_at":"2026-10-20"},{"id":"android-disassembler","name":"Android-Disassembler","name_zh":"Android-Disassembler 安卓端反汇编应用","url":"https://github.com/yhs0602/Android-Disassembler","evidence_url":"https://github.com/yhs0602/Android-Disassembler/blob/dde36d9b9ae4a62380607ae8eaba8d1ff5ea2888/README.md","description_en":"On-device disassembler and binary viewer for Android, built on Capstone, that opens ELF shared libraries and executables, object files, Windows PE files, .NET assemblies, dex files and APKs chosen from storage or from installed apps. It shows ELF details and symbol tables, PE import and export tables, disassembly with jump following and navigation by symbol or address, a hex view, ASCII string search and byte statistics such as entropy and chi-square tests to help tell whether data is encrypted. Analyses are kept as projects and can be exported as raw, text, JSON or database files.","description_zh":"基于 Capstone 的 Android 设备端反汇编器与二进制查看器，可打开从存储中选取或从已安装应用中选择的 ELF 共享库与可执行文件、目标文件、Windows PE 文件、.NET 程序集、dex 文件和 APK。它可显示 ELF 详细信息和符号表、PE 导入与导出表，提供支持跳转跟随及按符号或地址定位的反汇编视图、十六进制视图、ASCII 字符串搜索，以及熵和卡方检验等字节统计，帮助判断数据是否经过加密。分析结果以项目形式保存，并可导出为原始文件、文本、JSON 或数据库文件。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"bddisasm","name":"bddisasm","name_zh":"bddisasm x86/x64 指令解码库","url":"https://github.com/bitdefender/bddisasm","evidence_url":"https://github.com/bitdefender/bddisasm/blob/f0c0e90497d8905d81b7ed650646ea4dbf40bf65/README.md","description_en":"Bitdefender’s dependency-free C decoder for x86/x64 instructions, reporting explicit and implicit operands with their access modes, CPUID feature flags, flag accesses and valid modes, and printing Intel/MASM-style text. A minimal API with a 64-byte instruction structure trades detail for speed, and the companion bdshemu library emulates basic x86/x64 code in a raw buffer to flag shellcode-like behaviour such as NOP sleds, reading the instruction pointer, self-modification, TEB/PEB access and system calls. The disasmtool command-line example decodes or emulates files and hex strings.","description_zh":"Bitdefender 开发的 x86/x64 指令解码库，以 C 编写且无外部依赖，可报告显式与隐式操作数及其访问方式、CPUID 特性标志、标志位访问和有效模式，并输出 Intel／MASM 风格的反汇编文本。精简 API 使用 64 字节的指令结构，以较少的信息换取速度；配套的 bdshemu 库在原始缓冲区中模拟基本的 x86/x64 代码，用于标记类似 shellcode 的行为，例如 NOP 滑板、读取指令指针、自修改、访问 TEB/PEB 和系统调用。命令行示例 disasmtool 可对文件或十六进制字符串进行解码或模拟。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"decompyle3","name":"decompyle3","name_zh":"decompyle3 Python 3.7–3.8 字节码反编译器","url":"https://github.com/rocky/python-decompile3","evidence_url":"https://github.com/rocky/python-decompile3/blob/0b97289634ffed8b785be5463ebab7cdf1743a15/README.rst","description_en":"Reworking of uncompyle6 by the same author that translates Python 3.7 and 3.8 bytecode, including some PyPy 3.7 and 3.8 bytecode, back into equivalent Python source; older bytecode stays with uncompyle6. It disassembles code objects with the companion xdis library, then tokenizes and parses the instruction stream with a refactored grammar into a tree from which source is printed, and it can decompile between given start and stop offsets or, through decompyle3-code, only a file's lambdas, generators and comprehensions. The README says the grammar rewrite does not by itself fix uncompyle6's control-flow problem, which the author is addressing with dominator-based analysis in a separate, non-public project.","description_zh":"uncompyle6 作者对该项目的重构版本，可把 Python 3.7 和 3.8 的字节码（包括部分 PyPy 3.7 和 3.8 字节码）还原为等价的 Python 源码；更早版本的字节码仍由 uncompyle6 处理。它借助配套的 xdis 库反汇编代码对象，再用重构后的语法对指令流进行词法处理和解析，生成语法树并据此输出源码；它还能只反编译给定起止偏移之间的代码，或通过 decompyle3-code 只反编译文件中的 lambda、生成器和各类推导式。README 指出，仅靠语法重写并不能解决 uncompyle6 在控制流上的根本问题，作者正在另一个未公开的项目中用基于支配关系的分析来解决。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"fwhunt-scan","name":"FwHunt Community Scanner (fwhunt-scan)","name_zh":"FwHunt 社区版 UEFI 固件规则扫描器","url":"https://github.com/binarly-io/fwhunt-scan","evidence_url":"https://github.com/binarly-io/fwhunt-scan/blob/6fc7115959e4825199882f5b397a0d7c34cbbfd1/README.md","description_en":"Binarly's Python scanner that checks UEFI firmware modules against FwHunt rules, the YAML detection format for known UEFI firmware vulnerabilities whose rules are kept in the separate fwhunt repository. Its rizin-based analyzer reports a PE or TE module's Boot, Runtime and PEI service calls, protocols, PPIs, GUIDs, NVRAM variables and SMI handlers, which rules combine with code patterns, strings and hex strings. The CLI analyzes or scans one module, or extracts the modules of a whole firmware image and scans them, and the same classes work as a Python library.","description_zh":"Binarly 推出的 Python 扫描器，用 FwHunt 规则检查 UEFI 固件模块；FwHunt 是针对已知 UEFI 固件漏洞的 YAML 检测规则格式，规则本身存放在独立的 fwhunt 仓库中。其基于 rizin 的分析器可报告 PE 或 TE 模块的 Boot、Runtime 与 PEI 服务调用、协议、PPI、GUID、NVRAM 变量和 SMI 处理程序，规则将这些信息与代码模式、字符串和十六进制串组合匹配。命令行工具可分析或扫描单个模块，也可从整个固件镜像中提取模块后逐一扫描，相同的类也能作为 Python 库调用。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-20"},{"id":"drakvuf","name":"DRAKVUF","name_zh":"DRAKVUF 虚拟化黑盒二进制分析系统","url":"https://github.com/tklengyel/drakvuf","evidence_url":"https://github.com/tklengyel/drakvuf/blob/b2f64d8d73d456840e5fc276c13f0df0b2b79231/README.md","description_en":"Tamas K Lengyel's virtualization-based, agentless black-box binary analysis system: running on the Xen hypervisor through LibVMI, it traces execution in Windows and Linux guests, from kernel functions to user-mode code, without installing software inside the analyzed virtual machine. Plugins log system calls, API calls and file, registry, process, socket and memory activity, extract files from memory before they are deleted and dump process memory, while an injector starts programs in the guest without an in-guest helper. CERT Polska's separate DRAKVUF Sandbox builds an automated sandbox with a GUI on top of it.","description_zh":"由 Tamas K Lengyel 开发的基于虚拟化、无需代理的黑盒二进制分析系统：它运行在 Xen 虚拟机监控器上并借助 LibVMI，跟踪 Windows 和 Linux 客户机中从内核函数到用户态代码的执行过程，且无需在被分析的虚拟机内安装任何软件。各插件可记录系统调用、API 调用以及文件、注册表、进程、套接字和内存活动，在文件被删除前从内存中提取文件并转储进程内存；注入器无需客户机内辅助程序即可在客户机中启动程序。CERT Polska 另行开发的 DRAKVUF Sandbox 在其基础上构建了带图形界面的自动化沙箱。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"vipermonkey","name":"ViperMonkey","name_zh":"ViperMonkey VBA 恶意宏仿真分析引擎","url":"https://github.com/decalage2/ViperMonkey","evidence_url":"https://github.com/decalage2/ViperMonkey/blob/73547cef7f82dbcb10e22e36b84b558a07f7d21d/README.md","description_en":"VBA parser and emulation engine, created by Philippe Lagadec and developed since 2017 mainly by Kirk Sayre and other contributors, for analyzing and deobfuscating malicious macros in Microsoft Office files such as Word, Excel, PowerPoint and Publisher documents, as well as VBScript files and HTA files carrying VBScript. The vmonkey command reads the macros through oletools' olevba, emulates them from their auto-run entry points or from functions the analyst names, and reports the recorded actions, such as process creation, along with optional intermediate IOCs and the files the code would write; vbashell is an interactive VBA shell. A Python API evaluates VBA snippets, walks and emulates individual code blocks, replaces functions and deobfuscates code.","description_zh":"VBA 解析与仿真引擎，由 Philippe Lagadec 创建，自 2017 年起主要由 Kirk Sayre 及其他贡献者开发，用于分析和去混淆 Microsoft Office 文件（如 Word、Excel、PowerPoint 和 Publisher 文档）中的恶意宏，也可处理 VBScript 文件和内含 VBScript 的 HTA 文件。vmonkey 命令通过 oletools 的 olevba 读取宏，从自动运行入口或分析人员指定的函数开始仿真，报告记录到的行为（例如创建进程），并可列出中间 IOC 和代码将写出的文件；vbashell 则是交互式 VBA shell。其 Python API 可求值 VBA 代码片段、遍历并仿真单个代码块、替换函数以及对代码去混淆。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"linux-re-101","name":"linux-re-101","name_zh":"linux-re-101 Linux 逆向工程阅读清单","url":"https://github.com/michalmalik/linux-re-101","evidence_url":"https://github.com/michalmalik/linux-re-101/blob/f858da0f325aa4eb77008ba63d1bddfaf8d53d80/README.md","description_en":"Michal Malik’s single-README reading list for Linux reverse engineering, with about 230 links and book titles that run from quick references on system calls, ELF and processor ABIs through 101 and 201 tiers on program start-up, linking and relocations. Later sections gather material on packers and obfuscation, anti-debugging, ELF infection, kernel modules and rootkits, exploitation, crackmes, radare2 walkthroughs, detection tools and books. It is a lightly annotated link list last changed in January 2022, useful as a background syllabus rather than a maintained course.","description_zh":"Michal Malik 以单个 README 维护的 Linux 逆向工程阅读清单，收录约 230 条链接与书目：从系统调用、ELF 和各处理器 ABI 的速查资料，到讲解程序启动、链接与重定位的 101、201 两级阅读。后续部分汇集加壳与混淆、反调试、ELF 感染、内核模块与 rootkit、漏洞利用、crackme、radare2 实战、检测工具及书籍等资料。这是一份注释很少、最后改动于 2022 年 1 月的链接清单，适合作为背景阅读提纲，而不是持续维护的课程。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-20"},{"id":"xapkdetector","name":"XAPKDetector","name_zh":"XAPKDetector APK/DEX 检测工具","url":"https://github.com/horsicq/XAPKDetector","evidence_url":"https://github.com/horsicq/XAPKDetector/blob/09ce272fd312325678c864e9dd05f22070fe8b36/README.md","description_en":"APK and DEX detector from hors, the author of Detect-It-Easy, that reports the build tools, libraries and protections it identifies in Android packages, using scan engines and signature databases from the Detect-It-Easy family. The Qt GUI also shows AndroidManifest.xml, MANIFEST.MF, DEX and ELF contents, strings, hex, entropy, hashes and the APK signature, and can scan whole directories. A console build runs recursive, deep, heuristic or all-types scans and writes XML, JSON, CSV or TSV results.","description_zh":"由 Detect-It-Easy 作者 hors 开发的 APK 与 DEX 检测工具，借助 Detect-It-Easy 系列的扫描引擎和签名库，报告在 Android 软件包中识别出的构建工具、库和保护措施。其 Qt 图形界面还可查看 AndroidManifest.xml、MANIFEST.MF、DEX 和 ELF 内容，以及字符串、十六进制、熵、哈希和 APK 签名，并能扫描整个目录。命令行版本支持递归、深度、启发式或全类型扫描，并以 XML、JSON、CSV 或 TSV 格式输出结果。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"bread-bios-debugger","name":"BREAD","name_zh":"BREAD BIOS 实模式调试器","url":"https://github.com/Theldus/bread","evidence_url":"https://github.com/Theldus/bread/blob/700807ef312db8bb765f88eb4f702bc22b7b2858/README.md","description_en":"Injectable real-mode x86 debugger for legacy BIOS code, boot code and DOS programs on real hardware or in a virtual machine. A small 16-bit assembly stub placed in the target code installs interrupt handlers, single-steps the processor and talks over a serial line to a Linux bridge, which translates its simple packets into the GDB remote protocol so GDB can read and write memory and registers, step, continue and set one hardware breakpoint and one watchpoint at a time. A companion script turns an address–label list into a minimal ELF symbol file for GDB.","description_zh":"可注入的 x86 实模式调试器，用于在真实硬件或虚拟机上调试传统 BIOS 代码、引导代码和 DOS 程序。放入目标代码中的 16 位汇编小程序会安装中断处理程序、让处理器单步执行，并通过串口与 Linux 上的桥接程序通信；桥接程序把这些简化报文转换为 GDB 远程协议，使 GDB 能读写内存和寄存器、单步、继续执行，并可同时设置一个硬件断点和一个观察点。配套脚本可将地址与标签列表转换为供 GDB 加载的最小 ELF 符号文件。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-20"},{"id":"mergen","name":"Mergen","name_zh":"Mergen 反混淆 LLVM IR 提升器","url":"https://github.com/NaC-L/Mergen","evidence_url":"https://github.com/NaC-L/Mergen/blob/199805706ac00e156cc7e2a53ccc647c380f1786/README.md","description_en":"Function-level lifter that symbolically lifts one x86-64 function from a Windows PE binary into LLVM IR, then iterates LLVM and custom passes to a fixpoint so obfuscated or virtualized code reduces to simpler control flow and semantics for analysis. Its scope document lists 119 instruction handlers, two-way branches and tested jump-table shapes; README examples lift small test functions the authors protected with VMProtect and Themida, and the IR can be compiled for viewing in a decompiler.","description_zh":"函数级提升器：对 Windows PE 二进制中的单个 x86-64 函数进行符号化提升，生成 LLVM IR，再反复运行 LLVM 与自定义优化 pass 直至收敛，使经混淆或虚拟化的代码化简为更清晰的控制流和语义，便于分析。其范围文档列出 119 个指令处理器，支持双向分支和若干已测试的跳转表形态；README 示例提升的是作者自己用 VMProtect 和 Themida 保护的小型测试函数，输出的 IR 可编译后在反编译器中查看。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"readpe","name":"readpe (formerly pev)","name_zh":"readpe（原名 pev）PE 文件分析工具集","url":"https://github.com/mentebinaria/readpe","evidence_url":"https://github.com/mentebinaria/readpe/blob/967ab57f7cfbebf340a8f85744a1d095029cfbfe/README.md","description_en":"Command-line toolkit, formerly named pev, for analyzing 32- and 64-bit Windows PE files. readpe prints the DOS, COFF and optional headers, sections, data directories, imports and exports, while companion tools disassemble code (pedis), hash the file, headers or sections with ssdeep and imphash among others (pehash), list and extract resources (peres), match packer signatures (pepack), flag traits such as TLS callbacks, high entropy or an unusual entry point (pescan), report ASLR, DEP/NX, SEH and stack-cookie flags and dump certificates (pesec), find strings and convert between file offsets and RVAs. Output plugins write text, CSV, XML, HTML or JSON, and the bundled libpe C library provides the parser.","description_zh":"命令行工具集（原名 pev），用于分析 32 位和 64 位 Windows PE 文件。readpe 输出 DOS、COFF 与可选头、节区、数据目录以及导入和导出表；配套工具可反汇编代码（pedis），以 ssdeep、imphash 等算法对整个文件、文件头或节区计算哈希（pehash），列出并提取资源（peres），匹配加壳签名（pepack），标出 TLS 回调、高熵值或异常入口点等特征（pescan），报告 ASLR、DEP/NX、SEH 与栈 cookie 标志并导出证书（pesec），还能查找字符串以及在文件偏移和 RVA 之间换算。输出插件支持文本、CSV、XML、HTML 和 JSON，附带的 libpe C 库提供解析功能。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"sniffrom","name":"sniffROM","name_zh":"sniffROM 串行闪存被动嗅探重建工具","url":"https://github.com/alainiamburg/sniffROM","evidence_url":"https://github.com/alainiamburg/sniffROM/blob/a32be6150bc100ffa62dc996d045757fce2e5f67/README.md","description_en":"Python tool that reconstructs serial flash contents from passive bus captures: it parses SPI or I²C analyzer exports from Saleae Logic, recorded while a device reads and writes its own flash chip, and writes the observed data into a binary image at the original memory addresses. It recognizes more than 100 SPI flash commands from vendors such as Winbond, Macronix, Spansion and GigaDevice and currently parses 12 of them, reports manufacturer and device IDs seen in JEDEC ID reads, and can print a command summary, show a visual map of the captured address ranges and plot the timing of reads and writes.","description_zh":"通过被动总线抓包重建串行闪存内容的 Python 工具：它解析 Saleae Logic 的 SPI 或 I²C 分析器导出文件（这些数据记录了设备读写自身闪存芯片的过程），并把观察到的数据按原始内存地址写入二进制镜像。它可识别 Winbond、Macronix、Spansion、GigaDevice 等厂商的 100 多条 SPI 闪存命令，目前可解析其中 12 条，能报告 JEDEC ID 读取中出现的厂商和设备 ID，还可输出命令摘要、显示已捕获地址范围的可视化分布图，并绘制读写操作的时序图。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware","protocol"],"verified_at":"2026-10-20"},{"id":"idassist","name":"IDAssist","name_zh":"IDAssist IDA Pro 大模型辅助分析插件","url":"https://github.com/symgraph/IDAssist","evidence_url":"https://github.com/symgraph/IDAssist/blob/09dd910d70016c7b3f7e8bc01a4d5bc1035ec302/README.md","description_en":"IDA Pro plugin by Jason Tang, who also wrote GhidrAssist, that adds a dockable PySide6 panel for LLM-assisted analysis of the open database. Its tabs explain decompiled or disassembled functions with a security summary, keep persistent chats with context macros and an optional ReAct agent mode, propose function, variable and type renames for review before they are applied, and build a semantic knowledge graph of functions, calls, data flows and security traits, with retrieval over reference documents the analyst adds. Models can call built-in IDA tools or external MCP servers, and a SymGraph tab imports and publishes names, types and graph data through the hosted symgraph.ai service.","description_zh":"由 GhidrAssist 作者 Jason Tang 开发的 IDA Pro 插件，提供一个可停靠的 PySide6 面板，借助大语言模型分析当前打开的数据库。各标签页可解释反编译或反汇编后的函数并附安全摘要，保存带上下文宏和可选 ReAct 智能体模式的持久对话，为函数、变量和类型提出重命名建议并在审阅后应用，还能构建涵盖函数、调用、数据流和安全特征的语义知识图谱，并检索分析人员添加的参考文档。模型可以调用内置的 IDA 工具或外部 MCP 服务器；SymGraph 标签页则通过托管的 symgraph.ai 服务导入和发布名称、类型及图谱数据。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-20"},{"id":"google-pawn","name":"Pawn","name_zh":"Pawn Intel 平台 BIOS 固件提取工具","url":"https://github.com/google/pawn","evidence_url":"https://github.com/google/pawn/blob/45b7b3865c3d4f2aa6e0defebb477dacb8b8a3b9/README.md","description_en":"Linux command-line tool from Google that reads the BIOS/UEFI firmware image out of the SPI flash of Intel-based workstations and laptops. Running as root, it identifies the chipset's LPC bridge over PCI, maps the chipset's root-complex registers through /dev/mem, and reports the flash descriptor regions and the BIOS write- and read-protection settings it finds. It then reads the flash through the SPI controller's hardware sequencing into a single image file, which the README suggests processing further with tools such as UEFITool.","description_zh":"Google 发布的 Linux 命令行工具，可从基于 Intel 平台的工作站和笔记本电脑的 SPI 闪存中读出 BIOS/UEFI 固件镜像。它以 root 权限运行，通过 PCI 识别芯片组的 LPC 桥，借助 /dev/mem 映射芯片组的根复合体寄存器，并报告读到的闪存描述符分区以及 BIOS 写保护和读保护设置。随后它通过 SPI 控制器的硬件时序读取闪存，写入单个镜像文件；README 建议再用 UEFITool 等工具进一步处理。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-20"},{"id":"embark","name":"EMBArk","name_zh":"EMBArk EMBA 固件扫描 Web 平台","url":"https://github.com/e-m-b-a/embark","evidence_url":"https://github.com/e-m-b-a/embark/blob/d578c8b102bd6a74f9efaeb5c7e93c601a5a9663/README.md","description_en":"Web-based enterprise interface for the EMBA firmware security scanner, which it installs and runs as its scanning backend. In the browser, users upload firmware, configure and follow EMBA scans, open the full EMBA HTML report and a security overview per firmware, and compare results in an aggregated dashboard; results are access-controlled per user and can be archived. The current main branch adds a REST API for upload, scan status and SBOM retrieval, and an orchestrator that distributes scans to EMBA worker nodes reached over SSH.","description_zh":"EMBA 固件安全扫描器的 Web 企业级界面，会安装 EMBA 并将其作为扫描后端运行。用户可在浏览器中上传固件、配置并跟踪 EMBA 扫描，查看完整的 EMBA HTML 报告和每个固件的安全概览，并在汇总仪表板中比较结果；结果按用户控制访问，也可归档隐藏。当前 main 分支还加入了用于上传、查询扫描状态和获取 SBOM 的 REST API，以及通过 SSH 将扫描分派到 EMBA 工作节点的编排器。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-20"},{"id":"frida-labs","name":"Frida Labs","name_zh":"Frida Labs Android 插桩练习","url":"https://github.com/DERE-ad2001/Frida-Labs","evidence_url":"https://github.com/DERE-ad2001/Frida-Labs/blob/b01f2f8e4c479231ebf5763e94f695c88350c4f2/README.md","description_en":"Eleven Android challenge apps with step-by-step write-ups for learning Frida instrumentation, progressing from setting up frida-server and hooking a Java method through calling static methods, changing fields, creating instances and hooking constructors to hooking, calling and patching native functions. The author presents them as beginner-to-intermediate exercises rather than hard CTF challenges: each app hides a flag, but the stated goal is learning Frida’s common APIs and being able to read scripts written by others.","description_zh":"收录十一个 Android 挑战应用及逐步讲解，用于学习 Frida 插桩：从部署 frida-server、Hook Java 方法开始，依次练习调用静态方法、修改变量、创建实例和 Hook 构造函数，最后到 Hook、调用及修补原生函数。作者将其定位为入门到中级的练习，而非高难度 CTF：每个应用都藏有 flag，但目标是掌握 Frida 常用 API，并能读懂他人编写的脚本。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app"],"verified_at":"2026-10-20"},{"id":"malware-jail","name":"malware-jail","name_zh":"malware-jail JavaScript 恶意代码沙箱","url":"https://github.com/HynekPetrak/malware-jail","evidence_url":"https://github.com/HynekPetrak/malware-jail/blob/ec370f1433652fdd346995f1d6f00b26368aa611/README.md","description_en":"Node.js sandbox for semi-automatic analysis of JavaScript malware: it runs a sample in Node's vm module against emulated Windows Script Host and ActiveX objects such as WScript.Shell, MSXML2.XMLHTTP, ADODB.Stream, Scripting.FileSystemObject and WMI, plus a partial browser context with selectable browser profiles. It logs the objects created and methods called, keeps every eval() argument to help deobfuscation, records requested URLs and WMI queries, and saves the files a dropper tries to write so payloads can be examined. When the run ends, the whole sandbox context is dumped to JSON for review.","description_zh":"用于半自动分析 JavaScript 恶意代码的 Node.js 沙箱：在 Node 的 vm 模块中运行样本，并模拟 Windows Script Host 与 ActiveX 对象，例如 WScript.Shell、MSXML2.XMLHTTP、ADODB.Stream、Scripting.FileSystemObject 和 WMI，另有可选择浏览器配置的部分浏览器环境。它记录创建的对象和调用的方法，保留每次 eval() 的参数以辅助去混淆，记下请求的 URL 和 WMI 查询，并保存投放器试图写入的文件，便于检查载荷。运行结束时，整个沙箱上下文会导出为 JSON 供复查。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary","website"],"verified_at":"2026-10-20"},{"id":"idapython-embedded-toolkit","name":"IDAPython Embedded Toolkit","name_zh":"IDAPython Embedded Toolkit 嵌入式固件分析脚本集","url":"https://github.com/maddiestone/IDAPythonEmbeddedToolkit","evidence_url":"https://github.com/maddiestone/IDAPythonEmbeddedToolkit/blob/3cf0346f93eb3c009f4bf274c91bd00398a56d77/README.md","description_en":"Maddie Stone's IDAPython scripts for triaging and annotating embedded-device firmware images in IDA Pro, presented at RECON Montreal and DerbyCon in 2017. Triage scripts define code and functions from per-architecture prologue and epilogue patterns, mark address ranges as bytes, words or double words and turn unexplored bytes into strings; analysis scripts resolve memory accesses made at offsets from a known base value and add cross-references and value comments, and annotation scripts list CPU port (GPIO) use, tag functions without cross-references as possible dead code and trace where an operand is used. An Android folder adds a script that comments JNIEnv function calls in native libraries and one that decrypts the strings of ARM32 libraries packed with the WeddingCake anti-analysis wrapper.","description_zh":"Maddie Stone 编写的 IDAPython 脚本集，用于在 IDA Pro 中对嵌入式设备固件镜像进行初步梳理和标注，曾于 2017 年在 RECON Montreal 和 DerbyCon 上介绍。梳理类脚本依据各架构的函数序言和尾声模式定义代码与函数，把地址范围标记为字节、字或双字，并把未探索的字节转换为字符串；分析类脚本根据已知基址解析以偏移方式进行的内存访问，并添加交叉引用和数值注释；标注类脚本列出 CPU 端口（GPIO）的使用位置，把没有交叉引用的函数标为可能的死代码，并追踪某个操作数的使用位置。Android 文件夹另有一个为原生库中的 JNIEnv 函数调用添加注释的脚本，以及一个解密经 WeddingCake 反分析外壳打包的 ARM32 库中字符串的脚本。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["app","firmware"],"verified_at":"2026-10-20"},{"id":"osx-re-101","name":"osx & ios re 101","name_zh":"osx & ios re 101 macOS 与 iOS 逆向阅读清单","url":"https://github.com/michalmalik/osx-re-101","evidence_url":"https://github.com/michalmalik/osx-re-101/blob/486f33adf35848735327d9a83a05f9abd0f18af7/README.md","description_en":"A single-README reading list for macOS (OS X) and iOS reverse engineering, kept by Michal Malik from 2015 to 2019 and labelled a work in progress. Its 98 entries in nine sections run from must-read blogs and Mach-O, ABI and system-call references through Mach-O basics, malware, anti-debugging and obfuscation write-ups, kernel, sandbox and jailbreak research, kernel-extension development and kernel debugging, and forensics and monitoring material, to crackmes and six books. Entries are bare links or titles, mostly with no annotation.","description_zh":"以单个 README 维护的 macOS（OS X）与 iOS 逆向工程阅读清单，由 Michal Malik 于 2015 至 2019 年间整理，并标注为仍在进行中。九个部分共 98 个条目，依次涵盖必读博客与 Mach-O、ABI 和系统调用参考资料，Mach-O 基础知识，恶意软件、反调试和混淆相关文章，内核、沙箱与越狱研究，内核扩展开发与内核调试，取证与监控资料，以及 crackme 练习和六本书。条目只有链接或标题，大多没有说明。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"gxpc","name":"gxpc","name_zh":"gxpc XPC 通信嗅探工具","url":"https://github.com/ReverseApple/gxpc","evidence_url":"https://github.com/ReverseApple/gxpc/blob/4fad36db87126c0b29b987472b5863206fb77ac2/README.md","description_en":"macOS command-line XPC sniffer, inspired by xpcspy, that injects a Frida agent into an attached or newly spawned process and logs the XPC messages it sends and receives, labelled with the libxpc function, connection name, peer PID and process name. The agent recursively converts xpc_object_t dictionaries, arrays and scalar values into readable output and decodes binary-plist payloads, while a Go host built on frida-go selects a local, USB or remote Frida device, filters connections by name or PID and can save the trace to a file. It observes how Apple-platform apps and services communicate over XPC and does not alter or inject messages.","description_zh":"受 xpcspy 启发的 macOS 命令行 XPC 嗅探工具：把 Frida 代理注入已附加或新启动的进程，记录其收发的 XPC 消息，并标出对应的 libxpc 函数、连接名、对端 PID 与进程名。代理会递归地把 xpc_object_t 字典、数组和标量值转换为可读输出，并解码二进制 plist 负载；基于 frida-go 的 Go 主程序负责选择本地、USB 或远程 Frida 设备，按名称或 PID 过滤连接，并可将跟踪结果保存到文件。它用于观察 Apple 平台应用与服务如何通过 XPC 通信，不会修改或注入消息。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-20"},{"id":"jsxer","name":"Jsxer","name_zh":"Jsxer JSXBIN 反编译器","url":"https://github.com/AngeloD2022/jsxer","evidence_url":"https://github.com/AngeloD2022/jsxer/blob/0340bd3321be529cf775215cfac860cf2cf8b477/README.md","description_en":"C++ decompiler for JSXBIN, the binary format of Adobe's legacy ExtendScript, the ECMAScript 3 dialect used to script applications such as Photoshop, InDesign and After Effects. It reads a JSXBIN 1.0, 2.0 or 2.1 literal, parses it into a syntax tree and prints JavaScript source with a header naming the format version. An experimental --unblind option renames symbols obfuscated by JsxBlind, and the same decompiler is exposed as a shared library with a ctypes-based Python binding.","description_zh":"面向 JSXBIN 的 C++ 反编译器。JSXBIN 是 Adobe 旧版 ExtendScript 的二进制格式，ExtendScript 则是用于为 Photoshop、InDesign、After Effects 等应用编写脚本的 ECMAScript 3 方言。它读取 JSXBIN 1.0、2.0 或 2.1 字面量，解析为语法树，再输出 JavaScript 源码，并在文件头注明格式版本。实验性的 --unblind 选项可为经 JsxBlind 混淆的符号重新命名；同一反编译器还以共享库形式提供，并附基于 ctypes 的 Python 绑定。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"jni-helper","name":"jni_helper","name_zh":"jni_helper JNI 函数签名提取工具","url":"https://github.com/evilpan/jni_helper","evidence_url":"https://github.com/evilpan/jni_helper/blob/04b844c43438c2c0bbef29bf9b9695e5aba9a4bc/README.md","description_en":"Static helper by evilpan for reverse engineering Android JNI code. Its extract_jni.py script parses an APK's DEX files with Androguard, finds methods declared native, derives each one's mangled Java_ symbol name and C prototype, including overloaded methods, and saves them with the exported Java_ and JNI_OnLoad functions of the APK's arm64-v8a native libraries as a JSON signature file. Scripts for Ghidra, IDA Pro and Binary Ninja load that file and apply the prototypes and JNI types to the matching functions; a radare2 script is a work in progress.","description_zh":"evilpan 开发的 Android JNI 代码静态逆向辅助工具。其 extract_jni.py 脚本用 Androguard 解析 APK 中的 DEX 文件，找出声明为 native 的方法，推导出每个方法（包括重载方法）对应的 Java_ 修饰符号名和 C 函数原型，并连同 APK 中 arm64-v8a 原生库导出的 Java_ 函数和 JNI_OnLoad 一起保存为 JSON 签名文件。面向 Ghidra、IDA Pro 和 Binary Ninja 的脚本读取该文件，把函数原型和 JNI 类型应用到相应函数上；radare2 脚本仍在开发中。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"manticore","name":"Manticore","name_zh":"Manticore 符号执行工具","url":"https://github.com/trailofbits/manticore","evidence_url":"https://github.com/trailofbits/manticore/blob/cdf6c4b49603cc1d70a09cabe74e0f786df1e13f/README.md","description_en":"Trail of Bits' now-archived symbolic execution tool for Linux ELF binaries on x86, x86-64, AArch64 and ARMv7, Ethereum smart contracts as EVM bytecode, and WebAssembly modules. It runs a program on symbolic inputs to explore the states it can reach, generates concrete inputs that lead to a chosen state and detects crashes and other failures, solving constraints with an external Yices, Z3 or CVC4 solver. The manticore CLI writes generated test cases to an mcore_ workspace, while the Python API adds instruction hooks, event callbacks and custom initial states; manticore-verifier checks contract properties written in the contract's own language.","description_zh":"Trail of Bits 开发、现已归档的符号执行工具，可分析 x86、x86-64、AArch64 和 ARMv7 上的 Linux ELF 二进制、以 EVM 字节码表示的以太坊智能合约以及 WebAssembly 模块。它以符号输入运行程序，探索可到达的各个状态，生成能到达指定状态的具体输入，并检测崩溃等错误情形，约束由外部的 Yices、Z3 或 CVC4 求解器求解。manticore 命令行工具把生成的测试用例写入 mcore_ 工作目录，Python API 则支持指令钩子、事件回调和自定义初始状态；manticore-verifier 用于检查以合约自身语言编写的属性。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"awesome-executable-packing","name":"Awesome Executable Packing","name_zh":"Awesome Executable Packing 可执行文件加壳资源清单","url":"https://github.com/packing-box/awesome-executable-packing","evidence_url":"https://github.com/packing-box/awesome-executable-packing/blob/9e41a9b10b45535c1278259129ec8eaf287b8a42/README.md","description_en":"A single-README list of resources on executable packing, meaning the bundling, compression, encryption, mutation, protection or virtualization of PE, ELF and other executables, including Android apps, and on detecting and unpacking packed files. About 770 entries are grouped into documentation, dated scientific papers, sample datasets, packers sorted by era from before 2000 to after 2010, and tools for packer identification, unpacking and binary analysis.","description_zh":"以单个 README 维护的可执行文件加壳资源清单。加壳指对 PE、ELF 等可执行文件（包括 Android 应用）进行打包、压缩、编码、加密、变形、保护或虚拟化，清单也涵盖已加壳文件的检测与脱壳。约 770 个条目分为文档、注明日期的学术论文、样本数据集、按年代（2000 年以前至 2010 年以后）排列的加壳工具，以及用于加壳识别、脱壳和二进制分析的工具。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"fiano","name":"fiano","name_zh":"fiano UEFI 固件解析与修改工具集","url":"https://github.com/linuxboot/fiano","evidence_url":"https://github.com/linuxboot/fiano/blob/162b021e54496b89b2f9028f88234b2caec70a0c/README.md","description_en":"LinuxBoot's Go tools and libraries for parsing and modifying UEFI firmware images. Its utk command shows an image's firmware volumes and files as a table or JSON, finds, dumps, inserts, removes or replaces files, and extracts an image into a directory that can be reassembled, with a DXE cleaner for deleting unneeded DXE drivers. Further commands cover flash maps (fmap), coreboot CBFS, Intel FIT tables, FSP headers, microcode and LZMA data, and its Go packages also parse Intel ME regions, Boot Guard and CBnT manifests and AMD firmware structures.","description_zh":"LinuxBoot 项目用 Go 编写的 UEFI 固件镜像解析与修改工具及库。其 utk 命令可用表格或 JSON 展示镜像中的固件卷和文件，查找、转储、插入、删除或替换文件，并把镜像解包到可重新组装的目录中，还提供用于删除多余 DXE 驱动的 DXE 清理功能。其他命令涵盖闪存布局（fmap）、coreboot CBFS、Intel FIT 表、FSP 头部、微码和 LZMA 数据；其 Go 包还能解析 Intel ME 区域、Boot Guard 与 CBnT 清单以及 AMD 固件结构。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-20"},{"id":"deluder","name":"Deluder","name_zh":"Deluder 应用流量拦截工具","url":"https://github.com/Warxim/deluder","evidence_url":"https://github.com/Warxim/deluder/blob/068bb06429fa053011a61b0c91c26b7bef0996ed/README.md","description_en":"Frida-based interceptor for the traffic of proxy-unaware applications. JavaScript hook scripts on the send and receive functions of WinSock, Linux libc sockets, OpenSSL, GnuTLS and SChannel pass plaintext buffers to Python interceptor modules, which log them or forward them to a proxy for inspection. It spawns or attaches to a process, optionally through a remote frida-server, and was designed mainly as the backend for the author's PETEP proxy; a proxifier interceptor works with other proxy tools, and new scripts and interceptors can be added.","description_zh":"基于 Frida 的拦截工具，用于捕获不支持代理设置的应用程序的流量。JavaScript 挂钩脚本作用于 WinSock、Linux libc 套接字、OpenSSL、GnuTLS 和 SChannel 的收发函数，将明文缓冲区交给 Python 拦截模块记录日志，或转发到代理中查看。它可启动或附加到进程，也可通过远程 frida-server 操作，主要作为作者 PETEP 代理的后端而设计；proxifier 拦截模块可配合其他代理工具使用，并可添加新的脚本和拦截模块。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-20"},{"id":"pyrrha","name":"Pyrrha","name_zh":"Pyrrha 固件测绘工具","url":"https://github.com/quarkslab/pyrrha","evidence_url":"https://github.com/quarkslab/pyrrha/blob/54cfe78055740336283a02a75cfd8694f48cf2b9/README.md","description_en":"Quarkslab's firmware cartography tool, which indexes an extracted firmware filesystem into a database browsed with NumbatUI, Quarkslab's fork of the Sourcetrail code explorer. The fs mapper uses LIEF to map ELF and PE files, their imports and exports and the symlinks that point to them; fs-cg disassembles every executable with IDA Pro or Ghidra and links their call graphs across binaries, and decomp indexes one executable's decompiled functions with call cross-references. JSON exports can be post-processed in Python, for example to diff two firmware versions.","description_zh":"Quarkslab 的固件“测绘”工具，将已提取的固件文件系统编入数据库，再用 NumbatUI（Quarkslab 基于 Sourcetrail 代码浏览器的分支）浏览。fs 映射器借助 LIEF 映射 ELF 和 PE 文件、其导入与导出，以及指向这些文件的符号链接；fs-cg 用 IDA Pro 或 Ghidra 反汇编每个可执行文件，并把各二进制的调用图跨文件连接起来；decomp 则为单个可执行文件的反编译函数建立索引并附调用交叉引用。JSON 导出可用 Python 进一步处理，例如比较两个固件版本的差异。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-20"},{"id":"ghidragpt","name":"GhidraGPT","name_zh":"GhidraGPT：调用大模型辅助逆向的 Ghidra 扩展","url":"https://github.com/weirdmachine64/GhidraGPT","evidence_url":"https://github.com/weirdmachine64/GhidraGPT/blob/364e3f51e97736bea752132a2db06f8c7a6a10e4/README.md","description_en":"Ghidra extension that sends one function’s decompiled C to a hosted or local language model the user selects and streams the answer into a GhidraGPT console. Its three actions, offered in the Decompiler and Listing context menus, explain the function; rewrite it by writing recovered function, parameter and variable names, types, the prototype and inline comments back into the program; or audit it for likely security issues. Every action uses only the current function’s decompiler output, and the README calls audit findings leads to verify rather than sound static analysis.","description_zh":"Ghidra 扩展，把单个函数的反编译 C 代码发送给使用者选定的托管或本地大模型，并将回复流式显示在 GhidraGPT 控制台中。反编译视图和列表视图的右键菜单提供三项操作：解释函数；改写函数，把恢复出的函数名、参数名与变量名、类型、函数原型及行内注释写回程序；以及审查函数中可能存在的安全问题。每项操作只使用当前函数的反编译输出，README 称审查结果只是需要核实的线索，并非严谨的静态分析。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-20"},{"id":"ghidra-ninja-scripts","name":"Ghidra Ninja ghidra_scripts","name_zh":"Ghidra Ninja Ghidra 脚本合集","url":"https://github.com/ghidraninja/ghidra_scripts","evidence_url":"https://github.com/ghidraninja/ghidra_scripts/blob/99f2a8644a29479618f51e2d4e28f10ba5e9ac48/README.md","description_en":"Thomas Roth's (Ghidra Ninja) collection of Ghidra Python scripts, which appear under a Ghidra Ninja category in the Script Manager. binwalk.py and yara.py run binwalk or bundled YARA crypto-constant rules over the loaded program and bookmark the findings, YaraSearch.py does the same with a rule file the user chooses, swift_demangler.py demangles Swift function names, golang_renamer.py restores function names in stripped Go binaries from the .gopclntab table, and export_gameboy_rom.py writes a working ROM back out of a Game Boy program imported with GhidraBoy.","description_zh":"Thomas Roth（Ghidra Ninja）编写的 Ghidra Python 脚本合集，脚本会出现在 Script Manager 的 Ghidra Ninja 分类下。binwalk.py 和 yara.py 对已加载的程序运行 binwalk 或自带的 YARA 密码常量规则，并为发现的结果添加书签；YaraSearch.py 则使用用户选择的规则文件完成同样的工作；swift_demangler.py 还原 Swift 函数名；golang_renamer.py 依据 .gopclntab 表恢复去符号 Go 二进制中的函数名；export_gameboy_rom.py 可将用 GhidraBoy 导入的 Game Boy 程序重新导出为可运行的 ROM。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"budspro-headtracking-case","name":"BudsPro-Headtracking: streaming Galaxy Buds Pro head tracking over Samsung’s serial protocol","name_zh":"BudsPro-Headtracking：通过 Samsung 串口协议获取 Galaxy Buds Pro 头部追踪数据","url":"https://github.com/timschneeb/BudsPro-Headtracking","evidence_url":"https://github.com/timschneeb/BudsPro-Headtracking/blob/63b321aa0536fd28233eaaf3a05c4f3b3f8201fe/README.md","description_en":"Reimplements the Samsung Galaxy Buds Pro’s proprietary spatial-audio messages in a small Python script so that a PC can stream the earbuds’ head-tracking data in real time. It connects to the earbuds’ GEARMANAGER (or FACTORY) RFCOMM serial service, frames packets with start and end markers and a CRC16-CCITT checksum, enables the sensor stream with attach and two-second keep-alive messages, and decodes the rotation quaternion from the data events. A contributed script converts the quaternion to Euler angles and forwards it over local UDP to a Unity receiver; results are shown only as author-provided sample output.","description_zh":"用一个小型 Python 脚本重新实现 Samsung Galaxy Buds Pro 专有的空间音频消息，使电脑能实时获取耳机的头部追踪数据。脚本连接耳机的 GEARMANAGER（或 FACTORY）RFCOMM 串口服务，以起止标记和 CRC16-CCITT 校验封装数据包，通过 attach 消息和每两秒一次的保活消息开启传感器数据流，并从数据事件中解码旋转四元数。另有贡献者编写的脚本把四元数转换为欧拉角，经本机 UDP 转发给 Unity 接收端；效果仅以作者给出的示例输出展示。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-20"},{"id":"findcrypt-ghidra","name":"FindCrypt - Ghidra Edition","name_zh":"FindCrypt Ghidra 版密码常量识别脚本","url":"https://github.com/d3v1l401/FindCrypt-Ghidra","evidence_url":"https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/README.md","description_en":"Ghidra script that ports Ilfak Guilfanov's FindCrypt plugin for IDA, searching a program's memory or the current selection for constants of cryptographic and compression algorithms. Its serialized signature database keeps the original plugin's 79 algorithm constant sets and, by the README's count, holds 122 detectable constants for hash functions, block and stream ciphers, Curve25519 code, Keccak and zlib; when a whole constant is absent, the script also looks for its individual elements and reports partial matches above a detection threshold. Hits become Ghidra bookmarks and a results table from which matching data can be defined.","description_zh":"移植自 Ilfak Guilfanov 为 IDA 编写的 FindCrypt 插件的 Ghidra 脚本，在程序内存或当前选区中查找密码算法与压缩算法的常量。其序列化签名库保留了原插件的 79 组算法常量，按 README 的统计共含 122 个可检测常量，涵盖哈希函数、分组密码与流密码、Curve25519 代码、Keccak 和 zlib；若找不到完整常量，脚本还会查找其中的单个元素，并报告超过检测阈值的部分匹配。命中结果会生成 Ghidra 书签和结果表，可从表中将匹配位置定义为数据。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"reark","name":"ReArk","name_zh":"ReArk 鸿蒙与移动应用逆向分析工作台","url":"https://github.com/lkimuk/ReArk","evidence_url":"https://github.com/lkimuk/ReArk/blob/b4e83376dc0dfd82d26855c07610b135429328e3/README.md","description_en":"Desktop reverse-engineering and AI-assisted analysis workbench for HarmonyOS NEXT packages (.hap, .app and .abc), whose binary releases add Android .apk/.aab, iOS .ipa and standalone PE, ELF and Mach-O analysis. The README describes browsing package structure, resources, signatures and metadata, ABC bytecode disassembly and decompilation with strings and cross-references, Java-like Android decompilation, native header, import and mitigation views, and HDC/ADB device workflows for installing apps, reading logs and mirroring screens. Its built-in ReArk Agent answers questions about the open package with OpenAI-compatible or local Ollama models, retrieving package evidence on demand behind approval flows for host and device actions.","description_zh":"面向 HarmonyOS NEXT 安装包（.hap、.app 和 .abc）的桌面逆向与 AI 辅助分析工作台，其二进制发行版还加入了 Android .apk/.aab、iOS .ipa 以及独立 PE、ELF 和 Mach-O 文件的分析。README 介绍的功能包括浏览包结构、资源、签名和元数据，反汇编和反编译 ABC 字节码并查看字符串与交叉引用，Android 类 Java 反编译，原生文件的头部、导入表和安全缓解措施视图，以及通过 HDC/ADB 安装应用、读取日志和投屏的设备工作流。内置的 ReArk Agent 借助 OpenAI 兼容接口或本地 Ollama 模型回答关于当前包的问题，按需检索包内证据，主机和设备操作需经审批流程。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"binary-refinery","name":"Binary Refinery","name_zh":"Binary Refinery 二进制数据转换工具集","url":"https://github.com/binref/refinery","evidence_url":"https://github.com/binref/refinery/blob/13d8c68863c3d11d4e6cd36007fdd6c53459eda6/README.md","description_en":"Large collection of composable Python command-line units for transforming binary data: encodings, compression, encryption, archive and executable-format extraction, carving and pattern search. Each unit reads stdin and writes stdout, so units chain into shell pipelines, while framing, multibin arguments and meta variables let one pipeline process many chunks, and the binref command searches unit help. The author describes it as a command-line take on CyberChef focused on malware triage; the README also points to a separate binref/agent repository of instructions for language-model agents that use refinery.","description_zh":"由大量可组合的 Python 命令行单元组成的二进制数据转换工具集，涵盖编码、压缩、加密、归档与可执行文件格式提取、数据切割（carving）和模式搜索。各单元从标准输入读取、向标准输出写入，因此可串联成 shell 管道；分帧（framing）、multibin 参数和元变量使一条管道能处理多个数据块，binref 命令可检索各单元的帮助文本。作者称其为面向恶意软件初步分析、在命令行上实现类似 CyberChef 功能的工具；README 还指向独立的 binref/agent 仓库，其中提供供语言模型智能体使用 refinery 的说明。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"arsclib","name":"ARSCLib","name_zh":"ARSCLib Android 二进制资源读写库","url":"https://github.com/REAndroid/ARSCLib","evidence_url":"https://github.com/REAndroid/ARSCLib/blob/bd7221b43bc63544e712f3114dac635aa5142519/README.md","description_en":"Java library, modeled on AOSP's androidfw ResourceTypes.h and meant to replace aapt/aapt2, that reads, writes, modifies and creates Android resource tables (resources.arsc) and binary XML files such as AndroidManifest.xml. It decodes resources to readable JSON, which also handles obfuscated names, or to XML source when names are intact, and builds either form back into binary resources; APK module classes decode, merge and write whole packages. It also has an experimental DEX read/write package, and the APKEditor command-line tool is built on it.","description_zh":"参照 AOSP androidfw 中 ResourceTypes.h 的结构开发、旨在取代 aapt/aapt2 的 Java 库，可读取、写入、修改和创建 Android 资源表（resources.arsc）以及 AndroidManifest.xml 等二进制 XML 文件。它能将资源解码为可读的 JSON（也适用于名称已混淆的资源），或在名称完好时解码为 XML 源码，并把这两种形式重新构建为二进制资源；APK 模块类可解码、合并并写出整个安装包。库中另有实验性的 DEX 读写组件，命令行工具 APKEditor 即基于该库开发。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"pithus-bazaar","name":"Pithus (bazaar)","name_zh":"Pithus（bazaar）Android 应用分析平台","url":"https://github.com/Pithus/bazaar","evidence_url":"https://github.com/Pithus/bazaar/blob/3217f72f90fb95afcc9454ba8814b57a02acd56b/README.md","description_en":"Self-hostable Django platform behind the Pithus Android analysis service, which its README describes as built for activists, journalists, NGOs and researchers. An uploaded APK is stored under its SHA-256 and queued for static analyses: Androguard attribute and class extraction, APKiD compiler and packer identification, ssdeep and Dexofuzzy similarity, Quark-Engine behavior rules, androcfg call graphs, Exodus tracker signatures, a MobSF static report, APK signing-block metadata and analyst-written YARA rules with retrohunts over stored samples. Results are indexed in Elasticsearch and shown as web reports and through a REST API, optionally enriched with MalwareBazaar, VirusTotal, MISP and Google Play lookups.","description_zh":"Pithus Android 应用分析服务背后的可自托管 Django 平台，README 称其面向活动人士、记者、非政府组织和研究人员。上传的 APK 以 SHA-256 为名保存，并排队执行多项静态分析：用 Androguard 提取属性与类，用 APKiD 识别编译器与加壳工具，用 ssdeep 和 Dexofuzzy 计算相似度，用 Quark-Engine 规则识别行为，用 androcfg 生成调用图，匹配 Exodus 跟踪器特征，生成 MobSF 静态报告，读取 APK 签名块元数据，并运行分析者编写的 YARA 规则，还可对已存样本进行回溯检索。结果写入 Elasticsearch，以网页报告和 REST API 呈现，并可选用 MalwareBazaar、VirusTotal、MISP 和 Google Play 查询补充信息。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"angryghidra","name":"AngryGhidra","name_zh":"AngryGhidra Ghidra 符号执行插件","url":"https://github.com/Nalen98/AngryGhidra","evidence_url":"https://github.com/Nalen98/AngryGhidra/blob/0e6dc9c695de654367fbc0d9cd123a86791bff4d/README.md","description_en":"Ghidra extension that runs angr symbolic execution from a CodeBrowser panel. The analyst marks a destination address, an optional start address and addresses to avoid with hotkeys, and can make program arguments, memory ranges or registers symbolic, write concrete values into memory and registers, hook instructions or apply bytes patched in Ghidra to the angr project. A bundled Python script runs angr's explorer on the program's original file, the listing highlights the instructions along the path it finds, and the panel shows the argument, memory and stdin values that reach the destination.","description_zh":"在 CodeBrowser 面板中调用 angr 符号执行的 Ghidra 扩展。分析者可用快捷键标记目标地址、可选的起始地址和需要避开的地址，并可将程序参数、内存区域或寄存器设为符号值，向内存和寄存器写入具体值，钩住指定指令，或把在 Ghidra 中修补的字节应用到 angr 项目。随附的 Python 脚本对程序的原始文件运行 angr 路径探索，反汇编列表会高亮找到的路径上的指令，面板则显示能到达目标地址的参数、内存和标准输入取值。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"fpicker","name":"fpicker","name_zh":"fpicker Frida 插桩与覆盖率采集套件","url":"https://github.com/ttdennis/fpicker","evidence_url":"https://github.com/ttdennis/fpicker/blob/04f4b06b6c7a209986594a51bd51c8d8af7a75ea/README.md","description_en":"Frida-based fuzzing suite for closed-source programs, listed here for its in-process instrumentation and coverage layer. A JavaScript harness injected with Frida starts Stalker at an analyst-chosen function and records the basic blocks executed in the target module on each call, feeding either AFL++'s coverage bitmap or fpicker's own standalone mode. Its passive mode works as a tracer: it attaches to a running process without sending inputs and stores each input that reaches the function together with new coverage, on the local host or on USB and network devices running frida-server.","description_zh":"基于 Frida 的闭源程序模糊测试套件，本条目收录的是其进程内插桩与覆盖率采集部分。经 Frida 注入的 JavaScript 测试框架会在分析者选定的函数处启动 Stalker，记录每次调用时目标模块中执行过的基本块，再提供给 AFL++ 的覆盖率位图或 fpicker 自己的独立模式。其被动模式相当于跟踪器：附加到正在运行的进程而不发送输入，并在出现新覆盖时保存到达该函数的输入及对应覆盖信息，可用于本机，也可用于通过 USB 或网络连接、运行 frida-server 的设备。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"even-g2-ble-protocol-case","name":"Even G2 protocol: reverse-engineering Even Realities G2 smart-glasses BLE traffic","name_zh":"Even G2 协议：逆向分析 Even Realities G2 智能眼镜的 BLE 通信","url":"https://github.com/i-soxi/even-g2-protocol","evidence_url":"https://github.com/i-soxi/even-g2-protocol/blob/b227335f5fbecb7d4ede3748c36e098ef88850fa/README.md","description_en":"Documents the Bluetooth Low Energy protocol between the Even app and Even Realities G2 smart glasses, worked out from captured traffic: GATT characteristic UUIDs, an 8-byte transport header with sequence, multi-packet and two-byte service-ID fields, a CRC-16/CCITT over the payload, and protobuf payloads with draft .proto definitions. A Python example built on bleak sends the seven-packet session handshake and drives the teleprompter service to show custom text. The README’s status table marks connection, handshake, teleprompter and calendar widget as working, notifications as partial, and Even AI and navigation as still under research.","description_zh":"记录 Even 应用与 Even Realities G2 智能眼镜之间的低功耗蓝牙协议，依据抓取的通信流量推断得出：包括 GATT 特征 UUID、含序号、分包和双字节服务 ID 字段的 8 字节传输头、针对载荷计算的 CRC-16/CCITT，以及 protobuf 编码的载荷和初步的 .proto 定义。基于 bleak 的 Python 示例会发送七个报文的会话握手，并调用提词器服务显示自定义文字。README 的状态表将连接、握手、提词器和日历小组件标为可用，通知标为部分可用，Even AI 和导航仍在研究中。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-20"},{"id":"retrowrite","name":"RetroWrite","name_zh":"RetroWrite 静态二进制改写框架","url":"https://github.com/HexHive/retrowrite","evidence_url":"https://github.com/HexHive/retrowrite/blob/3b1e366ff8d2449a4f4c3157dd95c6f39c0a310b/README.md","description_en":"HexHive's static binary rewriter for x64 and aarch64 Linux ELF binaries, which turns a binary into symbolized, reassemblable assembly so instrumentation can be inserted without source code and without heuristics. Bundled passes add a binary-only AddressSanitizer and AFL coverage instrumentation, plus a coarse-grained control-flow-integrity pass on aarch64, and the symbolized assembly can also be edited by hand or by other tools before reassembly. The KRetrowrite variant of the x64 rewriter instruments Linux kernel modules with BASan or kcov for kernel fuzzing.","description_zh":"HexHive 开发的静态二进制改写工具，面向 x64 与 aarch64 的 Linux ELF 二进制：将二进制转换为符号化、可重新汇编的汇编代码，从而无需源码、也不依赖启发式规则即可插入插桩。附带的改写模块可添加仅针对二进制的 AddressSanitizer 和 AFL 覆盖率插桩，aarch64 上另有函数入口粗粒度控制流完整性模块；符号化的汇编也可在重新汇编前手工或用其他工具修改。x64 改写器的 KRetrowrite 变体可用 BASan 或 kcov 为 Linux 内核模块插桩，用于内核模糊测试。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"house","name":"House","name_zh":"House Android 运行时分析工具","url":"https://github.com/nccgroup/house","evidence_url":"https://github.com/nccgroup/house/blob/c3641e300d9c40568cd57dce1884f1a96c4c7849/README.md","description_en":"NCC Group’s Python and Flask web interface for Frida-based runtime analysis of Android apps, intended to make writing Frida scripts simpler. From a local browser page the analyst can enumerate loaded classes, the classes in a DEX file, class loaders and a class’s methods, then generate and keep tracing scripts for several functions, including ones in dynamically loaded DEX or JAR files. A configurable monitor logs file, HTTP, WebView, SQL, IPC and SharedPreferences calls.","description_zh":"NCC Group 基于 Python 和 Flask 开发的网页界面，用于借助 Frida 对 Android 应用进行运行时分析，旨在简化 Frida 脚本的编写。分析者可在本地浏览器页面中枚举已加载的类、DEX 文件中的类、类加载器及某个类的方法，再为多个函数生成并保存跟踪脚本，其中包括动态加载的 DEX 或 JAR 文件中的函数。可配置的监控功能会记录文件、HTTP、WebView、SQL、IPC 和 SharedPreferences 相关调用。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"abcde","name":"ABCDE","name_zh":"ABCDE OpenHarmony 逆向工具包","url":"https://github.com/Yricky/abcde","evidence_url":"https://github.com/Yricky/abcde/blob/62f7fc6a0d455d478db1bf3bcb61f2b79d5a473a/README.md","description_en":"Kotlin toolkit for OpenHarmony reverse engineering that parses Ark bytecode (.abc) files, the format HarmonyOS app packages carry in modules.abc, along with HAP packages and resource index (.index) files. Its Compose desktop viewer browses classes, methods, fields, literal arrays, imports and exports and disassembles methods, showing imported modules and resource references in readable form; an experimental mode translates some methods literally into JavaScript, and a CLI dumps class lists and resource indexes. The parsing core is also published as a JVM library, and the separate abc-decompiler builds on a patched fork of it.","description_zh":"使用 Kotlin 编写的 OpenHarmony 逆向工具包，可解析方舟字节码（.abc）文件，即 HarmonyOS 应用包中 modules.abc 的格式，也能解析 HAP 包和资源索引（.index）文件。其基于 Compose 的桌面查看器可浏览类、方法、字段、字面量数组及导入导出信息，并反汇编方法，以可读形式显示导入模块和资源引用；实验性功能可把部分方法直译为 JavaScript，命令行则可导出类列表和资源索引。解析核心也作为 JVM 库发布，另一个项目 abc-decompiler 即基于它的补丁分支。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"interruptor","name":"Interruptor","name_zh":"Interruptor 系统调用跟踪库","url":"https://github.com/FrenchYeti/interruptor","evidence_url":"https://github.com/FrenchYeti/interruptor/blob/6faa9f641884f90953080dde0a1a45cf96a76801/README.md","description_en":"Frida library, taken from the Dexcalibur project, that uses Frida’s Stalker to trace a process’s system calls and print strace-like lines with the calling thread, module and offset, decoded flag values and file paths resolved from descriptors. A trace can be limited to chosen modules and syscalls by name or pattern, started when a given library loads, extended with Interceptor-style per-syscall callbacks, and used to write drcov basic-block coverage files. The README documents Linux and Android on AArch64 and x64; the source also contains AArch32 Linux and macOS arm64 and x64 entry points.","description_zh":"源自 Dexcalibur 项目的 Frida 库，借助 Frida 的 Stalker 跟踪进程的系统调用，输出类似 strace 的记录，标明调用线程、模块与偏移，解码标志位取值，并根据文件描述符还原文件路径。跟踪范围可按名称或模式限定到指定模块和系统调用，可在某个库加载时启动，可附加 Interceptor 风格的逐系统调用回调，还能生成 drcov 基本块覆盖率文件。README 说明支持 AArch64 与 x64 上的 Linux 和 Android；源码中另有 AArch32 Linux 以及 macOS arm64、x64 的入口。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"de4js","name":"de4js","name_zh":"de4js JavaScript 反混淆与解包工具","url":"https://github.com/lelinhtinh/de4js","evidence_url":"https://github.com/lelinhtinh/de4js/blob/b06fff977739dd50eeaf42f602a712348aa01c84/README.md","description_en":"Browser-based JavaScript deobfuscator and unpacker, built as a Jekyll site that also works offline as a progressive web app. It detects or lets the user pick an encoding and reverses Dean Edwards' Packer, eval- and array-based obfuscators, some Obfuscator.IO output, JSFuck, JJencode, AAencode, URL encoding, My Obfuscate and WiseLoop, then beautifies and highlights the result, with options to unescape strings, merge strings, recover object paths and evaluate constant expressions. An optional userscript sends the code to the JS Nice service to rename unreadable identifiers.","description_zh":"在浏览器中运行的 JavaScript 反混淆与解包工具，以 Jekyll 网站形式构建，也可作为渐进式 Web 应用离线使用。它可自动识别或由使用者选择编码方式，还原 Dean Edwards 的 Packer、基于 eval 和数组的混淆器、部分 Obfuscator.IO 输出、JSFuck、JJencode、AAencode、URL 编码、My Obfuscate 和 WiseLoop，再对结果进行美化和语法高亮，并提供反转义字符串、合并字符串、恢复对象路径和计算常量表达式等选项。另有可选的用户脚本把代码发送到 JS Nice 服务，为难以阅读的标识符重新命名。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-20"},{"id":"awesome-ai-reverse","name":"Awesome AI Reverse Engineering","name_zh":"Awesome AI Reverse Engineering AI 逆向工具清单","url":"https://github.com/darbra/awesome-ai-reverse","evidence_url":"https://github.com/darbra/awesome-ai-reverse/blob/6459523eb2570a9f0da7b9589d9f7dfed54cead7/README.md","description_en":"A single-README, Chinese-language list of AI-assisted reverse-engineering projects, grouped into JavaScript reversing, binary and native analysis, Android and iOS security, and browser automation and traffic analysis. Its entries are mostly MCP servers, agent skills for Claude, Cursor and Codex, and IDE plugins that connect large language models to tools such as IDA Pro, Ghidra, Binary Ninja, JADX and Frida. Each row is a project name, a link and a one-line Chinese blurb.","description_zh":"以单个 README 维护的中文清单，收录与 AI 结合的逆向工程项目，按 JavaScript 逆向、二进制与原生分析、Android 与 iOS 安全、浏览器自动化与流量分析分组。条目大多是 MCP 服务器、面向 Claude、Cursor、Codex 的智能体技能，以及把大语言模型接入 IDA Pro、Ghidra、Binary Ninja、JADX、Frida 等工具的 IDE 插件。每一行是项目名称、链接和一句中文说明。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["app","binary","website"],"verified_at":"2026-10-20"},{"id":"dyld-cache-extract","name":"dyld_cache_extract","name_zh":"dyld_cache_extract dyld 共享缓存提取工具","url":"https://github.com/macmade/dyld_cache_extract","evidence_url":"https://github.com/macmade/dyld_cache_extract/blob/b29fbb9266c3c3b072c37c18bef3251105cd40b6/README.md","description_en":"macOS application and command-line tool that reads a dyld_shared_cache file from macOS or iOS, shows its header, mappings and image list, and copies one library or every library out to a directory. The CLI offers --info, --extract and --extract-all; the GUI presents the same header details and lets users select images to extract. The README marks the project obsolete and points to the author's dyld-cache-dump.","description_zh":"macOS 应用及命令行工具，可读取 macOS 或 iOS 的 dyld_shared_cache 文件，显示其头部、映射区和镜像列表，并将单个或全部动态库复制到指定目录。命令行提供 --info、--extract 和 --extract-all，图形界面显示同样的头部信息，并可选择要提取的镜像。README 已将项目标为过时，并推荐作者的 dyld-cache-dump。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"flare-ida","name":"FLARE IDA Pro utilities","name_zh":"FLARE IDA Pro 实用脚本合集","url":"https://github.com/mandiant/flare-ida","evidence_url":"https://github.com/mandiant/flare-ida/blob/fc667de6db279c6f8ec8bcc2f3eedff348db450f/README.md","description_en":"Archived collection of IDAPython plugins and scripts from Mandiant's FLARE team for malware and native-code analysis in IDA Pro. It searches code for precomputed API-name hashes used by shellcode, recovers strings built on the stack (statically, or by emulation with flare-emu in ironstrings), applies function types to structure fields and indirect calls, annotates imports with MSDN function, argument and constant information, and uses idb2pat to generate pattern files from an IDB's functions for building FLIRT signatures. Other scripts track static arguments to functions such as string decoders, link Objective-C selector references to their implementations in Mach-O files, and graft stub implementations of common Windows API imports so that decoding or unpacking code can run under IDA's Bochs emulation.","description_zh":"Mandiant FLARE 团队已归档的 IDAPython 插件与脚本合集，用于在 IDA Pro 中分析恶意软件和原生代码。它可在代码中搜索 shellcode 使用的预计算 API 名称哈希，恢复在栈上拼接的字符串（静态分析，或在 ironstrings 中借助 flare-emu 模拟执行），为结构体字段和间接调用应用函数类型，用 MSDN 中的函数、参数和常量信息注释导入函数，并通过 idb2pat 从 IDB 中的函数生成可用于制作 FLIRT 签名的模式文件。其他脚本可追踪字符串解码函数等调用的静态参数，在 Mach-O 文件中把 Objective-C 选择器引用关联到其实现，还能为常见 Windows API 导入函数植入简易实现，使解码或解包代码可在 IDA 的 Bochs 模拟模式下运行。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"binlex","name":"Binlex","name_zh":"Binlex 二进制特征词法框架","url":"https://github.com/c3rb3ru5d3d53c/binlex","evidence_url":"https://github.com/c3rb3ru5d3d53c/binlex/blob/f02f270c378b652dcfaca8a88f7d65bd4a95347b/README.md","description_en":"Binary trait-lexer framework that extracts instructions, basic blocks and functions from executables and emits searchable JSON traits for similarity, hunting and signature work. It models code with a genomics-inspired hierarchy and computes features such as MinHash, TLSH, SHA256, entropy and wildcard byte patterns, so samples can be compared, clustered and turned into signatures at scale. It ships a CLI suite, a Rust API, Python bindings and an IDA plugin, can generate YARA rules from its patterns, and runs processors locally or over IPC and HTTP.","description_zh":"二进制特征词法框架，从可执行文件中提取指令、基本块和函数，并输出可检索的 JSON 特征，用于相似度分析、威胁狩猎和签名工作。它以仿基因组学的层级结构对代码建模，计算 MinHash、TLSH、SHA256、熵和通配字节模式等特征，从而在大规模样本间进行比较、聚类并生成签名。它提供命令行工具套件、Rust API、Python 绑定和 IDA 插件，可依据其模式生成 YARA 规则，并支持本地或通过 IPC 与 HTTP 运行处理器。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"ghidrassist","name":"GhidrAssist","name_zh":"GhidrAssist Ghidra 大模型辅助分析扩展","url":"https://github.com/symgraph/GhidrAssist","evidence_url":"https://github.com/symgraph/GhidrAssist/blob/798a5d708124535aeb2ad8b7580ee08cfd14171b/README.md","description_en":"Ghidra extension by Jason Tang, who also wrote GhidrAssistMCP, that adds a tabbed GhidrAssist window to CodeBrowser for LLM-assisted analysis of the open program. Its tabs explain decompiled or disassembled functions with a security summary, keep persistent chats with context macros, MCP tool calling and an optional ReAct agent mode, propose function and variable renames, retypes and structures for review before they are applied, and build a semantic knowledge graph of functions, calls and security features with community detection, alongside Lucene retrieval over reference documents the analyst adds. A SymGraph tab imports and publishes names, types, graph data and documents through the hosted symgraph.ai service.","description_zh":"由 GhidrAssistMCP 作者 Jason Tang 开发的 Ghidra 扩展，在 CodeBrowser 中加入多标签页的 GhidrAssist 窗口，借助大语言模型分析当前打开的程序。各标签页可解释反编译或反汇编后的函数并附安全摘要，保存支持上下文宏、MCP 工具调用和可选 ReAct 智能体模式的持久对话，为函数和变量提出重命名、类型修改及结构体建议并在审阅后应用，还能构建涵盖函数、调用关系和安全特征的语义知识图谱并进行社区检测，同时可借助 Lucene 检索分析人员添加的参考文档。SymGraph 标签页则通过托管的 symgraph.ai 服务导入和发布名称、类型、图谱数据及文档。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-20"},{"id":"game-and-watch-patch-cfw-case","name":"game-and-watch-patch: Nintendo Game & Watch custom firmware","name_zh":"game-and-watch-patch：任天堂 Game & Watch 自定义固件","url":"https://github.com/BrianPugh/game-and-watch-patch","evidence_url":"https://github.com/BrianPugh/game-and-watch-patch/blob/857bb80fe77b60b6dabbadeae703577cc50f8645/README.md","description_en":"Custom firmware for the Mario and Zelda Game & Watch consoles that patches new C code into the user's own stock firmware backups, so the original firmware runs alongside the retro-go emulator. A Python patcher hooks stock function calls, relocates and LZMA-compresses stock code and data to free flash, and can merge both models' firmware into one image. Committed symbol maps, a cross-reference mapper and an analysis-ELF builder support the reverse engineering, and a journal records the author's first firmware-patching work.","description_zh":"面向马里奥和塞尔达两款 Game & Watch 掌机的自定义固件：把新编写的 C 代码修补进使用者自己的原厂固件备份，使原厂固件可与 retro-go 模拟器并存。Python 补丁工具会挂接原厂函数调用，重新定位原厂代码与数据并以 LZMA 压缩以腾出闪存，还能把两款机型的固件合并为一个镜像。仓库提交的符号表、交叉引用分析脚本和分析用 ELF 生成器支撑逆向工作，另有一份日志记录作者首次修补固件的过程。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","game"],"verified_at":"2026-10-20"},{"id":"driver-buddy-reloaded","name":"Driver Buddy Reloaded","name_zh":"Driver Buddy Reloaded Windows 内核驱动分析插件","url":"https://github.com/VoidSec/DriverBuddyReloaded","evidence_url":"https://github.com/VoidSec/DriverBuddyReloaded/blob/72bf7c862de01f389fa38651d9adc0f1042cbcba/README.MD","description_en":"IDA Pro Python plugin for triaging Windows kernel drivers, building on NCC Group's original DriverBuddy. Its auto-analysis identifies the driver model (WDM, KMDF, UMDF, WDF, Mini-Filter, Stream Minidriver, AVStream or PortCls), locates the device-control dispatch routines, labels IRP, IO_STACK_LOCATION and WDF structures and calls, and discovers and decodes IOCTL codes through Hex-Rays ctree, switch-table and immediate-operand scans. It also reports device names, symbolic links and device ACLs, pool tags, flagged APIs and opcodes, name-based call chains and heuristic vulnerability leads with per-IOCTL risk scores, in an IDA findings window, a JSON file and an HTML report.","description_zh":"用于分诊 Windows 内核驱动的 IDA Pro Python 插件，在 NCC Group 最初的 DriverBuddy 基础上发展而来。其自动分析可识别驱动模型（WDM、KMDF、UMDF、WDF、Mini-Filter、Stream Minidriver、AVStream 或 PortCls），定位设备控制派遣例程，标注 IRP、IO_STACK_LOCATION 和 WDF 结构及调用，并通过 Hex-Rays ctree、switch 跳转表和立即数操作数三种扫描发现并解码 IOCTL 码。它还会报告设备名、符号链接与设备 ACL、池标记、被标记的 API 和指令、基于名称的调用链，以及带逐个 IOCTL 风险评分的启发式漏洞线索，结果显示在 IDA 结果窗口中，并写入 JSON 文件和 HTML 报告。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"fa-firmware-analysis","name":"FA (Firmware Analysis)","name_zh":"FA（Firmware Analysis）符号定位自动化工具","url":"https://github.com/doronz88/fa","evidence_url":"https://github.com/doronz88/fa/blob/b584a37f920995310f257d428e1a0b387cbf489e/README.md","description_en":"Python framework, mainly used as an IDA plugin, that turns the manual steps of locating symbols, such as finding a string, following its cross-reference and taking the function start, into reusable signatures. Hjson SIG files, grouped into per-platform projects, chain commands that search bytes, strings, immediates or Keystone-assembled opcodes, filter by operands and cross-references, and then set names, types, constants, enums and struct members; Python scripts can drive the same interpreter. In IDA it adds an FA menu and toolbar to find all of a project's symbols, draft a temporary signature from the current function and export symbols plus a C header, and a separate loader runs signatures over a raw ELF file without IDA.","description_zh":"一个主要以 IDA 插件形式使用的 Python 框架，把定位符号时的手工步骤（例如查找字符串、跟随交叉引用、跳到函数起始处）写成可复用的签名。Hjson 格式的 SIG 文件按平台归入不同项目，其中串联的命令可搜索字节、字符串、立即数或用 Keystone 汇编出的指令，按操作数和交叉引用筛选，再设置名称、类型、常量、枚举和结构体成员；也可用 Python 脚本调用同一解释器。在 IDA 中，它添加 FA 菜单和工具栏，用于查找项目的全部符号、根据当前函数生成临时签名草稿，以及导出符号和 C 头文件；另有一个加载器可在不使用 IDA 的情况下对原始 ELF 文件运行签名。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-20"},{"id":"dexkit","name":"DexKit","name_zh":"DexKit 混淆 DEX 代码检索库","url":"https://github.com/LuckyPray/DexKit","evidence_url":"https://github.com/LuckyPray/DexKit/blob/f86a036ef2f000e3b42a2e52a25ae3f27770e7f0/README.md","description_en":"C++ DEX parsing library with Kotlin and Java APIs that loads an APK, DEX bytes or an app’s class loader and finds classes, methods and fields by their characteristics rather than their obfuscated names. Matchers combine package scope, modifiers and raw access flags, field, parameter and return types, annotations, the strings and numeric constants a method uses and the methods it calls, while batch queries locate many targets from strings at once; results expose opcodes, callers, invoked methods and fields used. Its guides centre on keeping Xposed hook points working across obfuscated app versions, and the same queries serve as a fast, scriptable search over an app’s bytecode.","description_zh":"以 C++ 实现的 DEX 解析库，提供 Kotlin 与 Java API，可加载 APK、DEX 字节数据或应用的类加载器，并按特征而非混淆后的名称查找类、方法和字段。匹配条件可组合包名范围、修饰符与原始访问标志、字段类型、参数类型和返回类型、注解、方法使用的字符串与数值常量以及其调用的方法；批量查询可依据字符串一次定位多个目标，查询结果还提供操作码、调用者、被调用方法和所用字段。其文档以让 Xposed Hook 点在混淆后的不同应用版本间保持可用为主要场景，同样的查询也可用来快速、可编程地检索应用字节码。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"androidreverse101","name":"AndroidReverse101","name_zh":"AndroidReverse101（Android 逆向 100 天教程）","url":"https://github.com/Evil0ctal/AndroidReverse101","evidence_url":"https://github.com/Evil0ctal/AndroidReverse101/blob/9b72d20439155893ab2ce1b8af56af41c17d0411/README.md","description_en":"A Chinese-language Android reverse-engineering course by Evil0ctal, planned as 100 daily lessons. It starts from number systems, ARM assembly, the Dalvik/ART runtime and APK loading, then covers APK and DEX structure, Smali editing and repackaging, Frida and Xposed hooking, JNI and native-library analysis, traffic analysis, obfuscation and app hardening, with commands and code for tools such as jadx, apktool, readelf, GDB/LLDB, Frida and Burp Suite. A Crackmes folder adds copies of OWASP's UnCrackable and r2pay practice apps, and a community Indonesian translation follows the published lessons.","description_zh":"Evil0ctal 编写的中文 Android 逆向课程，计划分 100 天、每天一课。课程从进制、ARM 汇编、Dalvik/ART 运行时和 APK 加载机制讲起，继而介绍 APK 与 DEX 结构、Smali 修改与重新打包、Frida 和 Xposed Hook、JNI 与 Native 库分析、抓包分析、代码混淆及应用加固，并结合 jadx、apktool、readelf、GDB/LLDB、Frida、Burp Suite 等工具给出命令和代码。Crackmes 目录收录 OWASP UnCrackable 与 r2pay 练习应用的副本，另有社区贡献的印度尼西亚语译本与已发布课程对应。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app"],"verified_at":"2026-10-20"},{"id":"fuji-cam-wifi-tool-protocol-case","name":"fuji-cam-wifi-tool: reconstructing Fujifilm X-series Wi-Fi remote control","name_zh":"fuji-cam-wifi-tool：重建 Fujifilm X 系列相机 Wi-Fi 遥控协议","url":"https://github.com/hkr/fuji-cam-wifi-tool","evidence_url":"https://github.com/hkr/fuji-cam-wifi-tool/blob/c597fc42151f0e4c726714e63dd13552b9fad3aa/README.md","description_en":"Reimplements the Wi-Fi remote-control protocol of Fujifilm X-series cameras as a C++ library and an interactive command-line client that joins the camera's access point. Its headers name the control, event and JPEG live-view ports, message types and camera property codes, and source comments keep hex traces of exchanges along with what \"the app\" sends; the client connects, fires the shutter, records video, adjusts exposure settings and focus point, and streams live view, optionally into a Linux webcam device. README calls the tool very limited and mostly undocumented, so the protocol knowledge lives in code and comments rather than a specification.","description_zh":"以 C++ 库和交互式命令行客户端重新实现 Fujifilm X 系列相机的 Wi-Fi 遥控协议，客户端需接入相机自建的无线接入点。头文件列出控制、事件和 JPEG 实时取景所用端口、报文类型及相机属性代码，源码注释保留了若干交互的十六进制记录，并注明“the app”发送的内容；客户端可连接相机、触发快门、录制视频、调整曝光参数与对焦点，并传输实时取景画面，还可选择输出到 Linux 摄像头设备。README 称该工具功能很有限、基本没有文档，因此协议知识只存在于代码和注释中，并无成文规范。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-20"},{"id":"pyinstxtractor-ng","name":"pyinstxtractor-ng (PyInstaller Extractor Next Generation)","name_zh":"pyinstxtractor-ng 新一代 PyInstaller 程序提取工具","url":"https://github.com/pyinstxtractor/pyinstxtractor-ng","evidence_url":"https://github.com/pyinstxtractor/pyinstxtractor-ng/blob/1ed86ccc575cf10a42454a217e72540adf359f2e/README.md","description_en":"Fork of PyInstaller Extractor (pyinstxtractor) by the same author that extracts the bundled CArchive files and PYZ modules from Linux ELF and Windows PE executables built with PyInstaller, writing .pyc files with repaired headers for a separate bytecode decompiler. Unlike the original script, it unmarshals the PYZ archive with the xdis library, so it does not have to run under the Python version that built the executable, and it automatically decrypts PYZ entries that PyInstaller's optional AES encryption protected, using the key module bundled in the same executable. A one-directory mode extracts the PYZ next to the other files so the result can be run directly, and --info prints archive metadata such as versions, entry points and encryption without writing files.","description_zh":"PyInstaller Extractor（pyinstxtractor）的同一作者所做的分支版本，可从 PyInstaller 构建的 Linux ELF 和 Windows PE 可执行文件中提取打包的 CArchive 文件和 PYZ 模块，并输出修复了文件头的 .pyc 文件，供另行使用的字节码反编译器处理。与原脚本不同，它借助 xdis 库反序列化 PYZ 归档，因此无须在构建该可执行文件时所用的 Python 版本下运行；对于经 PyInstaller 可选 AES 加密保护的 PYZ 条目，它会利用同一可执行文件中打包的密钥模块自动解密。单目录模式会把 PYZ 内容提取到其他文件旁边，便于直接运行提取结果；--info 选项则只输出版本、入口点和加密情况等归档元数据，而不写入任何文件。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"retracker","name":"RETracker","name_zh":"RETracker Polyend Tracker 逆向工程框架","url":"https://github.com/patois/RETracker","evidence_url":"https://github.com/patois/RETracker/blob/f6698f602fe41fededfd9f19fbe1b74bf68a85f0/README.md","description_en":"Python reverse-engineering framework for the Polyend Tracker music device that patches the vendor's stock firmware, replacing an unused USB RAWHID handler with its own command handler. With the patched firmware flashed, a host CLI reads, hex-dumps and disassembles device memory in ARM or Thumb mode, writes memory, runs code at an address, assembles and executes position-independent \"Polyp\" modules such as a pad text scroller and screen fades, and copies files to the SD card over USB. Its fwtool.py also unpacks and repacks the Intel HEX .ptf firmware images for loading into a disassembler.","description_zh":"面向 Polyend Tracker 音乐设备的 Python 逆向工程框架：为厂商原版固件打补丁，用自己的命令处理程序替换一个未使用的 USB RAWHID 处理程序。刷入打过补丁的固件后，主机命令行工具即可按 ARM 或 Thumb 模式读取、十六进制转储和反汇编设备内存，还能写入内存、在指定地址执行代码，汇编并运行称为“Polyp”的位置无关模块（如在打击垫上显示滚动文字和屏幕淡入淡出），以及通过 USB 向 SD 卡复制文件。其 fwtool.py 还可解包和重新打包 Intel HEX 格式的 .ptf 固件镜像，便于载入反汇编器。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-20"},{"id":"cobra-mba-simplifier","name":"CoBRA (Coefficient-Based Reconstruction of Arithmetic)","name_zh":"CoBRA 混合布尔-算术表达式化简器","url":"https://github.com/trailofbits/CoBRA","evidence_url":"https://github.com/trailofbits/CoBRA/blob/af44b8ad7c8ec548d431463475e93b0118e77a29/README.md","description_en":"Trail of Bits' C++23 simplifier for Mixed Boolean-Arithmetic (MBA) expressions, an obfuscation technique that rewrites simple computations as interleaved arithmetic, bitwise and shift operations. Given an expression and a bit width from 1 to 64, cobra-cli returns a simpler equivalent: a worklist scheduler combines signature-vector and change-of-basis techniques, semilinear handling of constant masks, polynomial recovery, decomposition of mixed products and subexpression lifting, and each result is checked on random inputs or, optionally, with a Z3 equivalence proof. The same engine is available as a library and as an optional LLVM pass plugin that simplifies MBA expressions it detects in LLVM IR.","description_zh":"Trail of Bits 开发的 C++23 混合布尔-算术（MBA）表达式化简器。MBA 是一种混淆技术，会把简单运算改写为算术、按位与移位运算交织的复杂形式。cobra-cli 接受一个表达式和 1 至 64 位的位宽，输出更简单的等价式：工作列表调度器组合签名向量与基变换技术、带常量掩码的半线性处理、多项式恢复、混合乘积分解和子表达式提升，每个结果都会用随机输入抽查，也可选用 Z3 做等价性证明。同一引擎还以库的形式提供，并可编译为 LLVM 优化遍插件，对其在 LLVM IR 中检测到的 MBA 表达式进行化简。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"piccante","name":"PiCCANTE","name_zh":"PiCCANTE 树莓派 Pico 车辆 CAN 总线工具","url":"https://github.com/Alia5/PiCCANTE","evidence_url":"https://github.com/Alia5/PiCCANTE/blob/62ede82f56ae1cc4addf9ef7b7bf20d447d8d712/Readme.md","description_en":"Raspberry Pi Pico firmware and hardware designs for a low-cost CAN bus interface aimed at exploring and reverse engineering vehicle networks. It runs two CAN 2.0B channels on RP2040 boards or three on RP2350 boards through the PIO-based can2040 library and exposes them over USB as a GVRET device for SavvyCAN and as per-channel SLCAN devices for Linux SocketCAN via can-utils. A configuration shell, a partial ELM327 emulator for OBD-II PID requests with ISO-TP multi-frame replies, and Wi-Fi, Bluetooth and a web interface on Pico W boards complete the firmware, alongside perfboard and KiCad PCB designs with 3D-printable cases for an OBD-II dongle.","description_zh":"基于 Raspberry Pi Pico 的低成本 CAN 总线接口固件与硬件设计，用于探索和逆向分析车辆网络。它借助基于 PIO 的 can2040 库，在 RP2040 开发板上运行两路、在 RP2350 开发板上运行三路 CAN 2.0B 通道，并通过 USB 以 GVRET 设备的形式供 SavvyCAN 使用，同时为每个通道提供 SLCAN 设备，经 can-utils 接入 Linux SocketCAN。固件还包括配置命令行、可处理 OBD-II PID 请求（含 ISO-TP 多帧应答）的部分 ELM327 模拟器，以及 Pico W 开发板上的 Wi-Fi、蓝牙和网页界面；仓库另附 OBD-II 适配器的洞洞板与 KiCad PCB 设计及可 3D 打印的外壳。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-20"},{"id":"gymnasticon-exercise-bike-bridge-case","name":"Gymnasticon: bridging proprietary exercise-bike data to standard cycling sensors","name_zh":"Gymnasticon：将专有健身单车数据转为标准骑行传感器信号","url":"https://github.com/ptx2/gymnasticon","evidence_url":"https://github.com/ptx2/gymnasticon/blob/e142f539c518d6d4ced3abdd587a825b918a9367/README.md","description_en":"Node.js bridge that reads power and cadence from exercise bikes whose own apps or services are gone or closed, and re-broadcasts them as standard Bluetooth LE Cycling Power and Cycling Speed and Cadence sensors and as an ANT+ bike power profile, so that Zwift, TrainerRoad, bike computers and watches can use the bike. The author's development notes describe working out the Flywheel Home Bike's stats packets on its Bluetooth UART service after the vendor shut its home service down; Peloton support reads the bike's data cable through a USB serial adapter, while the Schwinn IC4 and Keiser M clients parse the standard Fitness Machine Service and Keiser's documented broadcasts. Bike and app compatibility is project-reported.","description_zh":"一个 Node.js 桥接程序：从官方应用或服务已停用或不开放的健身单车读取功率和踏频，再以标准的低功耗蓝牙 Cycling Power、Cycling Speed and Cadence 传感器及 ANT+ 自行车功率配置文件重新广播，使 Zwift、TrainerRoad、码表和运动手表能够使用这辆单车。作者的开发笔记记录了在厂商关停家用服务后，如何在 Flywheel Home Bike 的蓝牙 UART 服务上解析出其统计数据包；Peloton 支持通过 USB 串口适配器读取单车的数据线，Schwinn IC4 和 Keiser M 客户端则分别解析标准的 Fitness Machine Service 和 Keiser 公开文档中的广播数据。单车与应用的兼容性均为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-20"},{"id":"iw4l-mw2-rust-runtime-case","name":"IW4L: a Rust runtime that plays Modern Warfare 2 from the user’s installed game","name_zh":"IW4L：用使用者已安装的游戏运行《现代战争 2》的 Rust 运行时","url":"https://github.com/vladtrc/iw4L","evidence_url":"https://github.com/vladtrc/iw4L/blob/acc57a5c9dd027db8eb5ef17c792fa69f059daa1/README.md","description_en":"Implements a standalone runtime for Call of Duty: Modern Warfare 2 (2009) in Rust on Bevy and wgpu, loading maps, models, textures and weapons from the user’s installed game through native FastFile readers and translating its Direct3D 9 shaders to WGSL. Bots, demo recording and replay, and multiplayer over custom UDP with a QUIC master are implemented, while README warns that gameplay remains incomplete, with missing behavior, bugs and desyncs. README states that the whole project is written by an LLM; NOTICE names the community projects consulted and says the original binaries were read with Ghidra.","description_zh":"以 Rust 基于 Bevy 和 wgpu 实现《使命召唤：现代战争 2》（2009）的独立运行时：通过原生 FastFile 读取器从使用者已安装的游戏中载入地图、模型、纹理和武器，并将其 Direct3D 9 着色器转换为 WGSL。已实现机器人、录像录制与回放，以及基于自定义 UDP 和 QUIC 主服务器的多人游戏；但 README 提醒游戏玩法仍不完整，存在缺失行为、错误和不同步。README 声明整个项目由大语言模型编写；NOTICE 列出参考过的社区项目，并说明曾用 Ghidra 阅读原版二进制文件。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"skate-3-rust-engine-case","name":"Skate 3 Rust Engine: a Bevy rewrite built on Skate 3 reverse-engineering research","name_zh":"Skate 3 Rust Engine：基于《Skate 3》逆向研究的 Bevy 重写","url":"https://github.com/SK8-ENGINE/skate-3-rust-engine","evidence_url":"https://github.com/SK8-ENGINE/skate-3-rust-engine/blob/2e16697797c8358d16f747a8259354ff2921041a/README.md","description_en":"Reimplements Skate 3’s skating, tricks, grinds and offboard movement in a new Rust and Bevy engine that runs on assets converted from the user’s own Xbox 360 copy, adding difficulty settings and a .skate custom-map format. Physics notes cite functions and constants read from the original executable in IDA, and audio research reads traces from a research-hooks branch of a separate Skate 3 static recompilation. README says gameplay parity is still a work in progress, credits dumbad’s years of format research and states that AI coding tools were used to write the rewrite.","description_zh":"在新的 Rust 与 Bevy 引擎中重新实现《Skate 3》的滑行、技巧、擦边滑行和下板移动，运行时使用从使用者自有 Xbox 360 版游戏转换得到的素材，并加入难度设置和 .skate 自定义地图格式。物理说明引用了在 IDA 中读取的原版可执行文件的函数和常量，音频研究则读取另一个《Skate 3》静态重编译项目 research-hooks 分支产生的跟踪记录。README 称游戏玩法与原版的一致性仍在完善中，肯定了 dumbad 多年的格式研究，并说明这次重写借助了 AI 编程工具。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"rikugan","name":"Rikugan","name_zh":"Rikugan","url":"https://github.com/buzzer-re/Rikugan","evidence_url":"https://github.com/buzzer-re/Rikugan/blob/a2ba6691baa0a7ace3bce9fe834a4f6f7610b77d/README.md","description_en":"IDA Pro and Binary Ninja plugin that runs its own agent loop inside the disassembler: a model the user chooses streams its answers and calls more than 60 in-process tools for navigation, decompilation, disassembly, cross-references, strings, types, annotations, scripting and host IL or microcode edits. An orchestrator can map a binary and spawn parallel subagents, findings persist in a RIKUGAN.md file beside the database, and experimental commands apply plain-language patches or, on Binary Ninja, remove control-flow flattening and other obfuscation. README says it was vibecoded with Claude Code.","description_zh":"IDA Pro 与 Binary Ninja 插件，在反汇编器内运行自己的智能体循环：使用者选定的模型以流式输出作答，并调用 60 多个进程内工具，涵盖导航、反编译、反汇编、交叉引用、字符串、类型、注释、脚本以及宿主 IL 或微码编辑。编排器可先梳理整个二进制文件，再并行派出子智能体；分析结论保存在数据库旁的 RIKUGAN.md 中；实验性命令可按自然语言描述打补丁，或在 Binary Ninja 上去除控制流平坦化等混淆。README 称该项目是与 Claude Code 一起“氛围编程”完成的。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"ollvm-unflattener","name":"ollvm-unflattener","name_zh":"ollvm-unflattener OLLVM 控制流平坦化去混淆工具","url":"https://github.com/cdong1012/ollvm-unflattener","evidence_url":"https://github.com/cdong1012/ollvm-unflattener/blob/d0062012b66ab2c845207c733216900d5e99f0a9/README.md","description_en":"Python command-line deobfuscator for the control-flow flattening applied by Obfuscator-LLVM (OLLVM). Given a flattened function's address, it uses Miasm's symbolic execution to track the dispatcher's state variable, records which blocks each state value selects and which state follows it, and writes a copy of the binary in which the function is reassembled with Keystone in its recovered order; an optional mode also follows the function's calls. The README covers 32- and 64-bit x86 Windows and Linux binaries and contrasts this approach with MODeflattener's static one.","description_zh":"针对 Obfuscator-LLVM（OLLVM）控制流平坦化的 Python 命令行去混淆工具。给定被平坦化函数的地址后，它借助 Miasm 的符号执行跟踪分发器的状态变量，记录每个状态值对应的基本块及其后继状态，再用 Keystone 按恢复出的顺序重新汇编该函数，并写出一份修改后的二进制副本；可选模式还会沿该函数的调用继续处理。README 涵盖 32 位和 64 位 x86 的 Windows 与 Linux 二进制，并将这种做法与 MODeflattener 的静态方法作了对比。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"lostmycode-javascript-deobfuscator","name":"javascript-deobfuscator (LostMyCode)","name_zh":"javascript-deobfuscator Obfuscator.io 字符串还原网页工具（LostMyCode）","url":"https://github.com/LostMyCode/javascript-deobfuscator","evidence_url":"https://github.com/LostMyCode/javascript-deobfuscator/blob/2cc31bf07d9f870ea0871aabf3af5568d165f57d/README.md","description_en":"Browser-based Vue app that restores the strings Obfuscator.io hides behind string-array lookups in JavaScript. The user pastes the obfuscated script and names its string array or decoder function, such as _0x439c; the tool classifies the calls as plain array indexing, a one-argument decoder or a two-argument RC4-style decoder, runs the script's own decoder to replace each call with its string literal, rewrites bracketed property access as dot notation and beautifies the result. The author hosts a demo at deo.sigr.io.","description_zh":"基于浏览器的 Vue 应用，用于还原 Obfuscator.io 藏在字符串数组查找背后的 JavaScript 字符串。用户粘贴混淆脚本，并填写其中的字符串数组或解码函数名（如 _0x439c）；工具会把调用识别为直接数组下标、单参数解码函数或双参数 RC4 式解码函数，借助脚本自带的解码函数把每次调用替换为字符串字面量，再把方括号属性访问改写为点号形式并美化输出。作者在 deo.sigr.io 提供演示站点。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-20"},{"id":"bun-demincer","name":"bun-demincer","name_zh":"bun-demincer Bun 可执行文件 JavaScript 还原工具","url":"https://github.com/vicnaum/bun-demincer","evidence_url":"https://github.com/vicnaum/bun-demincer/blob/7cfe9254bca0ce7428a5574d7da8d4d8e51f511c/README.md","description_en":"Node.js pipeline that recovers readable JavaScript from Bun-compiled standalone executables. It extracts the embedded module graph and assets, splits the bundle into one file per module, flags npm vendor code with a fingerprint database, and deobfuscates with wakaru, format-preserving renames recovered from export mappings and optional Gemini-suggested names. Dependency-graph clustering, manual or LLM-assisted cluster labels and cross-version artifact transfer then organize and update the output.","description_zh":"从 Bun 编译的独立可执行文件中恢复可读 JavaScript 的 Node.js 流程。它提取内嵌的模块图和资源，把打包代码拆成每个模块一个文件，用指纹库标记 npm 第三方代码，再借助 wakaru、依据导出映射恢复名称的保格式重命名以及可选的 Gemini 命名建议进行反混淆。之后通过依赖图聚类、手工或借助 LLM 的聚类命名，以及跨版本迁移已有成果，来整理和更新输出。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"ghidra-golanganalyzerextension","name":"GolangAnalyzerExtension","name_zh":"GolangAnalyzerExtension Ghidra Go 分析扩展","url":"https://github.com/mooncat-greenpy/Ghidra_GolangAnalyzerExtension","evidence_url":"https://github.com/mooncat-greenpy/Ghidra_GolangAnalyzerExtension/blob/c0d1540f16409c8b0b202b10a005ce484f9e7705/README.md","description_en":"Ghidra extension whose Golang Analyzer reads the runtime header and module data in Go binaries built with go1.6 through go1.27 to identify the Go version, rename functions, correct their arguments, comment source files and line numbers, add Go types to the Data Type Manager and label Go strings. A plugin window lists the recovered functions, types, source files and strings with links to Go source, and WebAssembly builds are handled when a separate Wasm loader such as ghidra-wasm-plugin is installed. A bundled script also renames functions that decode gobfuscate-style obfuscated strings and comments the decoded text.","description_zh":"Ghidra 扩展，其 Golang Analyzer 读取 go1.6 至 go1.27 所编译 Go 二进制中的运行时头部和模块数据，用以识别 Go 版本、重命名函数、修正参数、以注释标出源文件与行号，把 Go 类型加入数据类型管理器，并标注 Go 字符串。插件窗口列出恢复出的函数、类型、源文件和字符串，并可链接到 Go 源码；另行安装 ghidra-wasm-plugin 等 Wasm 加载器后，也能处理 WebAssembly 构建。随附的脚本还会为解码 gobfuscate 式混淆字符串的函数重命名，并以注释写出解码后的文本。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"ida-ios-helper","name":"IDA iOS Helper","name_zh":"IDA iOS Helper iOS 逆向辅助插件","url":"https://github.com/yoavst/ida-ios-helper","evidence_url":"https://github.com/yoavst/ida-ios-helper/blob/65c7b03171f006c4fe476bca4bceefe25d24769f/README.md","description_en":"IDA Pro plugin that cleans up Hex-Rays pseudocode and adds navigation helpers for iOS user-mode binaries and the kernelcache, enabling its components according to the loaded file. For Objective-C and Swift code it hides reference-counting calls, selectors and static class arguments, collapses os_log sequences, turns property helpers into plain assignments or field reads, lists cross-references to a method's selector, and adds Swift type declarations and readable stack strings. For kernelcaches it types the results of safeMetaCast and typed operator new, names and types kalloc_type_view globals, fixes this arguments and lists the possible implementations of a virtual call, while shared helpers remove __break calls, rewrite ranged conditions, collapse block initializers and mark outlined functions.","description_zh":"一款 IDA Pro 插件，用于清理 Hex-Rays 伪代码，并为 iOS 用户态二进制和 kernelcache 提供导航辅助，会根据所加载的文件启用相应组件。对 Objective-C 和 Swift 代码，它可隐藏引用计数调用、选择器和静态类参数，折叠 os_log 调用序列，把属性辅助函数还原为普通赋值或字段读取，列出方法选择器的交叉引用，并加入 Swift 类型声明和可读的栈上字符串。对 kernelcache，它可为 safeMetaCast 和带类型的 operator new 的返回值设置类型，为 kalloc_type_view 全局变量命名并设置类型，修正 this 参数，并列出虚函数调用的所有可能实现；通用辅助功能则会移除 __break 调用、改写范围条件、折叠 block 初始化代码并标记外提（outlined）函数。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-20"},{"id":"mambo","name":"MAMBO","name_zh":"MAMBO 动态二进制修改框架","url":"https://github.com/beehive-lab/mambo","evidence_url":"https://github.com/beehive-lab/mambo/blob/dcdf19a751092c18cccc1e31fea684dfc599c8b8/README.md","description_en":"Dynamic binary modification framework from the University of Manchester that runs unmodified Linux user-space programs on 32-bit Arm (A32/T32), AArch64 and RV64GC RISC-V, translating their code into a code cache as it executes. An event-driven C plugin API registers callbacks on code-scanning and execution events and emits instrumentation; sample plugins count instruction mixes, branches and blocks, trace memory accesses and system calls, find hotspots, simulate caches, check memory errors and detect data races.","description_zh":"曼彻斯特大学开发的动态二进制修改框架，可在 32 位 Arm（A32/T32）、AArch64 和 RV64GC RISC-V 上运行未经修改的 Linux 用户态程序，并在执行过程中把代码翻译到代码缓存里运行。事件驱动的 C 插件 API 可在代码扫描与执行事件上注册回调并生成插桩代码；示例插件可统计指令构成、分支与基本块次数，跟踪内存访问和系统调用，查找热点，模拟缓存，检查内存错误并检测数据竞争。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"garmin-ble-gfdi-protocol-case","name":"garmin-ble: a Python client for Garmin's GFDI watch protocol","name_zh":"garmin-ble：Garmin 手表 GFDI 协议的 Python 客户端","url":"https://github.com/gwerneckp/garmin-ble","evidence_url":"https://github.com/gwerneckp/garmin-ble/blob/b66203232f0abb314aeb7dc9e448680184f28ed3/README.md","description_en":"Python library that talks to Garmin watches over their proprietary GFDI V2 Bluetooth LE protocol, with no Garmin Connect, phone or cloud service. It implements the handshake, multi-link routing, COBS framing, CRC16 checks and protobuf service messages, streams typed readings such as heart rate, HRV, SpO2, stress, Body Battery and accelerometer data, and adds a simulator and recorded-session replay for work without hardware. Its acknowledgements credit Gadgetbridge for the protocol logic and schemas, while a published journal shows how the author decoded the accelerometer payload, which Gadgetbridge only logged, from labelled recordings.","description_zh":"一个 Python 库，通过 Garmin 手表专有的 GFDI V2 低功耗蓝牙协议与手表通信，无需 Garmin Connect、手机或云服务。它实现了握手、多链路路由、COBS 分帧、CRC16 校验和 protobuf 服务报文，可流式读取心率、HRV、血氧、压力、Body Battery 和加速度计等类型化数据，并提供模拟器和录制会话回放，便于在没有硬件时开发。致谢部分说明协议逻辑和 schema 源自 Gadgetbridge；另有一份公开的分析记录，展示作者如何依据带标注的录制数据解出加速度计载荷，而 Gadgetbridge 此前只记录其十六进制内容。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-20"},{"id":"vanbus","name":"VanBus","name_zh":"VanBus PSA VAN 总线收发库","url":"https://github.com/0xCAFEDECAF/VanBus","evidence_url":"https://github.com/0xCAFEDECAF/VanBus/blob/0c22517eb1a94fa65df98faecd2cf86abbf8fc85/README.md","description_en":"Arduino library for ESP8266/ESP8285 and ESP32 boards that receives and transmits packets on the VAN (Vehicle Area Network) comfort bus that PSA fitted to Peugeot and Citroën models until about 2009. It decodes the signal from a GPIO pin, wired through a CAN transceiver or a receive-only resistor divider, in software into packets with identifier, command flags, data and a 15-bit CRC that it can check or try to repair by flipping single bits, and reports queue and error statistics. Example sketches dump raw packets, send a packet, and parse comfort-bus traffic into readable fields on the serial port or a live web page.","description_zh":"面向 ESP8266/ESP8285 和 ESP32 开发板的 Arduino 库，可在 VAN（Vehicle Area Network）舒适系统总线上收发报文；PSA 在 2009 年前的部分标致和雪铁龙车型中使用这种总线。它用软件解码经 CAN 收发器或仅供接收的电阻分压电路接入 GPIO 引脚的信号，得到包含标识符、命令标志、数据和 15 位 CRC 的报文，可校验 CRC，或通过逐位翻转尝试修复，并提供队列与错误统计。示例程序可转储原始报文、发送报文，并在串口或实时网页上把舒适总线流量解析为可读字段。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-20"},{"id":"class-informer","name":"Class Informer","name_zh":"Class Informer MSVC RTTI 类信息插件","url":"https://github.com/kweatherman/IDA_ClassInformer_PlugIn","evidence_url":"https://github.com/kweatherman/IDA_ClassInformer_PlugIn/blob/dfb865248d38684d06bf0e53799430b068a5d2d0/README.md","description_en":"IDA Pro plugin that scans Microsoft Visual C++ binaries for virtual function tables (vftables) through their C++ run-time type information (RTTI), names, labels and comments the vftables it finds, defines the RTTI data structures and identifies single, multiple and virtual inheritance in each class hierarchy. It also processes static initializer and terminator tables, and opens a list window of the vftables with their method counts and class hierarchies, where each line jumps to its vftable. Its author notes that IDA 9's built-in RTTI plugin now finds nearly all of this data, so the current version only sets types that IDA missed and serves mainly as a gathering and browsing view.","description_zh":"一款 IDA Pro 插件，借助 C++ 运行时类型信息（RTTI）扫描 Microsoft Visual C++ 编译的二进制中的虚函数表（vftable），为找到的虚函数表命名、添加标签和注释，定义 RTTI 数据结构，并识别各类层次结构中的单继承、多继承和虚继承。它还会处理静态初始化与终止函数表，并打开一个列表窗口，显示各虚函数表的方法数量和类层次结构，点击任一行即可跳转到对应的虚函数表。作者指出，IDA 9 内置的 RTTI 插件现已能找到几乎全部此类数据，因此当前版本只为 IDA 遗漏的结构设置类型，主要用作汇总和浏览视图。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"bravo-minecraft-server-case","name":"Bravo: a reverse-engineered Minecraft server","name_zh":"Bravo：逆向实现的 Minecraft 服务端","url":"https://github.com/bravoserver/bravo","evidence_url":"https://github.com/bravoserver/bravo/blob/7be5d792871a8447499911fa1502c6a7c1437dc3/README.rst","description_en":"Reimplements the server side of Minecraft’s Alpha- and Beta-era multiplayer in Python on Twisted; its documentation calls it a reverse-engineered implementation written from scratch, credits network traffic dumps and says general Minecraft data went to a community wiki. The final 2.0 release speaks the 1.4.x client protocol for login, chunk transfer, entities, server-side inventories, lighting, physics and Anvil saves, while deliberately changing behaviour such as chunk loading and item stacking. A pluggable architecture adds terrain generation, seasons and commands, and small scripts inspect packets, NBT and region files.","description_zh":"以 Python 基于 Twisted 重新实现 Minecraft Alpha 与 Beta 时期多人游戏的服务端；其文档称这是从零编写的逆向实现，致谢了网络流量转储的提供者，并说明通用的 Minecraft 资料已贡献给社区 wiki。最终的 2.0 版支持 1.4.x 客户端协议，涵盖登录、区块传输、实体、服务端背包、光照、物理和 Anvil 存档，同时有意改变了区块加载和物品堆叠等行为。可插拔架构提供地形生成、季节和命令，另有几个小脚本用于查看数据包、NBT 和区域文件。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game","protocol"],"verified_at":"2026-10-20"},{"id":"dex-oracle","name":"dex-oracle","name_zh":"dex-oracle Dalvik 反混淆工具","url":"https://github.com/CalebFenton/dex-oracle","evidence_url":"https://github.com/CalebFenton/dex-oracle/blob/d6be172b925e52421c092c574b74a3783b9e7901/README.md","description_en":"Pattern-based Dalvik deobfuscator that takes an APK, a DEX file or a Smali directory, disassembles it with baksmali and runs plugins that look for obfuscation patterns in the Smali code. To learn what a matched call returns, such as a decrypted string, it merges a small driver into the app's DEX, pushes it to a connected Android device or emulator and invokes the static method there through reflection; the result replaces the call as a constant before the APK or DEX is reassembled. Plugins cover simple string encryption, indexed string and class lookups, certain DexGuard patterns and some reflection, and the author describes it as the inspiration for Simplify.","description_zh":"基于模式匹配的 Dalvik 反混淆工具，可处理 APK、DEX 文件或 Smali 目录：先用 baksmali 反汇编，再由各插件在 Smali 代码中查找混淆模式。为得知匹配到的调用会返回什么（例如解密后的字符串），它把一个小型驱动程序合并进应用的 DEX，推送到已连接的 Android 设备或模拟器，并通过反射在设备上调用对应的静态方法；返回值以常量替换原调用，之后再重新组装 APK 或 DEX。插件涵盖简单字符串加密、按索引查找字符串和类、部分 DexGuard 模式以及部分反射调用；作者称它启发了另一个反混淆工具 Simplify。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"ghidra-snippets","name":"Ghidra Snippets","name_zh":"Ghidra Snippets Ghidra 脚本示例集","url":"https://github.com/HackOvert/GhidraSnippets","evidence_url":"https://github.com/HackOvert/GhidraSnippets/blob/9bcd718e8958387ff5695194b83a52df4e0a3de7/README.md","description_en":"A single-page collection of 30 commented Python examples for scripting Ghidra, grouped by task: projects, programs, functions and cross-references, basic blocks, instructions, stack variables, decompiler output, comments, P-code emulation and dumps, call graphs and program slices. It starts from the Flat Program, Flat Decompiler and Flat Debugger APIs, then shows where a task needs Ghidra's fuller API; most snippets include an example of their output.","description_zh":"单页汇集 30 个带注释的 Ghidra Python 脚本示例，按任务分组：项目、程序、函数与交叉引用、基本块、指令、栈变量、反编译输出、注释、P-code 模拟与导出、调用图和程序切片。示例从 Flat Program、Flat Decompiler 和 Flat Debugger API 入手，再说明哪些任务需要 Ghidra 更完整的 API；大多数示例附有输出样例。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-20"},{"id":"minusone-script-deobfuscator","name":"minusone","name_zh":"minusone 脚本去混淆引擎","url":"https://github.com/airbus-cert/minusone","evidence_url":"https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/README.md","description_en":"Airbus CERT's Rust deobfuscation engine for scripts: it parses PowerShell or JavaScript with tree-sitter, applies rules that infer the values of syntax-tree nodes and prints a simplified script. The PowerShell rules fold arithmetic, string operations, casts, -join, -replace and format operators, Base64 and UTF decoding, predictable variables and loops, and also resolve Gzip or Deflate streams and AES decryption when the data and key are in the script; the newer JavaScript rules cover literals, operators, string and array built-ins, atob and btoa, Buffer calls, predictable function calls and JSFuck constructs. The CLI can list, select or skip rules and export every rewrite step as HTML or JSON, and Python and WebAssembly bindings embed the engine, including in an online version linked from the README.","description_zh":"Airbus CERT 开发的 Rust 脚本去混淆引擎：用 tree-sitter 解析 PowerShell 或 JavaScript，应用一组推断语法树节点取值的规则，再输出化简后的脚本。PowerShell 规则可折叠算术与字符串运算、类型转换、-join、-replace 和格式化运算符、Base64 与 UTF 解码、可预测的变量和循环；当数据和密钥都在脚本中时，还能还原 Gzip 或 Deflate 流以及 AES 解密。较新的 JavaScript 规则涵盖字面量、运算符、字符串与数组内置方法、atob 与 btoa、Buffer 调用、可预测的函数调用以及 JSFuck 写法。命令行工具可列出、选用或跳过规则，并把每一步改写导出为 HTML 或 JSON；Python 和 WebAssembly 绑定可嵌入该引擎，README 中链接的在线版本即基于此。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-20"},{"id":"kam1n0","name":"Kam1n0","name_zh":"Kam1n0 汇编代码克隆搜索平台","url":"https://github.com/McGill-DMaS/Kam1n0-Community","evidence_url":"https://github.com/McGill-DMaS/Kam1n0-Community/blob/1c3c309acc8f5e50c6617f858aa3b5b84c121b26/README.md","description_en":"Server platform from McGill University's Data Mining and Security Lab that indexes collections of disassembled binaries into shared repositories and searches them for cloned assembly functions. Its applications cover subgraph clone search within one instruction-set family (Asm-Clone), cross-architecture semantic search over VEX IR using symbolic and concrete execution (Sym1n0), Asm2Vec representation learning aimed at compiler optimization and obfuscation, and executable classification built on Asm2Vec. An IDA Pro plug-in sends functions to the server and shows flow-graph, text-diff and clone-group views; the README's accuracy and query-time figures come from the authors' own papers.","description_zh":"McGill 大学数据挖掘与安全实验室开发的服务端平台，可把大量已反汇编的二进制建立索引、存入可共享的仓库，并在其中搜索克隆的汇编函数。平台提供多种应用：在同一指令集家族内进行子图克隆搜索（Asm-Clone），借助符号执行与具体执行在 VEX IR 上进行跨架构语义搜索（Sym1n0），面向编译优化与混淆的 Asm2Vec 表示学习，以及基于 Asm2Vec 的可执行文件分类。IDA Pro 插件把函数发送到服务端，并以控制流图、文本差异和克隆分组视图展示结果；README 中的准确率与查询耗时数据出自作者自己的论文。","kind":"tool","category":"binary-diffing","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"bn-binary-ninja-agent-cli","name":"bn","name_zh":"bn：面向智能体的 Binary Ninja 命令行工具","url":"https://github.com/banteg/bn","evidence_url":"https://github.com/banteg/bn/blob/bd910329547303c787a68fcd8309e83ab1be6590/README.md","description_en":"Agent-oriented command-line interface for the Binary Ninja database already open in the GUI, reached through a companion plugin that listens on a local Unix-domain socket. Agents read decompilation, IL, disassembly, cross-references, callsites, types and data, export multi-function bundles and run unrestricted Python inside Binary Ninja; renames and prototype, structure and type edits can be previewed, are verified after they apply and roll back on failure. Large text output spills to hashed artifact files, and a packaged Codex skill describes the workflow.","description_zh":"面向智能体的命令行工具，用于操作已在 Binary Ninja 图形界面中打开的数据库，通过监听本地 Unix 域套接字的配套插件连接。智能体可读取反编译结果、中间语言、反汇编、交叉引用、调用点、类型和数据，导出多函数打包结果，并在 Binary Ninja 内运行不受限制的 Python；重命名以及函数原型、结构体和类型修改可先预览，应用后会校验结果，失败时回滚。较大的文本输出会转存为附带哈希的产物文件，随包提供的 Codex 技能说明了使用流程。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-20"},{"id":"quarkslab-titanm-tools","name":"Titan M tools (Quarkslab)","name_zh":"Quarkslab Titan M 安全芯片研究工具","url":"https://github.com/quarkslab/titanm","evidence_url":"https://github.com/quarkslab/titanm/blob/7b6c2524600185a819b3f7b0113f258bcf0ff36a/README.md","description_en":"Tools Quarkslab published from its research on Google's Titan M security chip in Pixel phones: a Ghidra loader for Titan M (Citadel) firmware files, nosclient for tracing and sending the chip's protobuf-based commands from Android with a black-box fuzzer built on libprotobuf-mutator, a parser for sigrok SPI captures, and scripts that convert firmware images to the rec files of the chip's SPI rescue feature. The repository also holds the Black Hat Europe 2021 white paper and slides, the ROOTS'21 paper and the Black Hat USA 2022 slides, which describe reverse engineering the firmware, sniffing its SPI communication with the application processor, and black-box and emulation-based fuzzing; the authors say the vulnerabilities they found were disclosed to Google.","description_zh":"Quarkslab 发布的 Google Pixel 手机 Titan M 安全芯片研究工具：包括用于 Titan M（Citadel）固件文件的 Ghidra 加载器；可在 Android 上跟踪并发送芯片基于 protobuf 的命令的 nosclient，内含基于 libprotobuf-mutator 的黑盒模糊测试器；sigrok SPI 抓包解析器；以及把固件镜像转换为芯片 SPI rescue 功能所用 rec 文件的脚本。仓库还收录 Black Hat Europe 2021 白皮书与幻灯片、ROOTS'21 论文和 Black Hat USA 2022 幻灯片，介绍固件逆向、嗅探芯片与应用处理器之间的 SPI 通信，以及黑盒与基于仿真的模糊测试；作者称所发现的漏洞均已向 Google 披露。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware","protocol"],"verified_at":"2026-10-20"},{"id":"iblessing","name":"iblessing","name_zh":"iblessing iOS 应用与 Mach-O 分析工具集","url":"https://github.com/Soulghost/iblessing","evidence_url":"https://github.com/Soulghost/iblessing/blob/ff14351de3f3c2155e8df47c26d4367523af7628/README.md","description_en":"Toolkit for analyzing iOS apps and arm64 Mach-O binaries, built on Capstone, Unicorn and Keystone. Its scanners extract app-bundle metadata such as URL schemes and transport-security settings, locate Objective-C class references and NSPredicate uses, detect symbol wrappers, and partially emulate arm64 code with Unicorn to recover objc_msgSend cross-references, including those passed through blocks. Generators turn the reports into IDA Pro scripts that add cross-references and rename wrappers, or into a local query server, and a shared core library with a plug-in interface supports custom tools.","description_zh":"用于分析 iOS 应用和 arm64 Mach-O 二进制的工具集，基于 Capstone、Unicorn 与 Keystone 构建。其扫描器可提取应用包元数据（如 URL Scheme 和传输安全设置），定位 Objective-C 类引用和 NSPredicate 用法，识别符号包装函数，并借助 Unicorn 部分模拟 arm64 代码以恢复 objc_msgSend 交叉引用，包括经由 block 传递的调用。生成器可把扫描报告转成 IDA Pro 脚本，用于添加交叉引用和重命名包装函数，也可启动本地查询服务；共享核心库及插件接口可用于开发自定义工具。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-27"},{"id":"ntrghidra","name":"NTRGhidra","name_zh":"NTRGhidra Nintendo DS 程序 Ghidra 加载器","url":"https://github.com/pedro-javierf/NTRGhidra","evidence_url":"https://github.com/pedro-javierf/NTRGhidra/blob/9e0674c0b36ef9b816dbe7833a68b17327edc1b9/README.md","description_en":"Ghidra loader and plugin for Nintendo DS programs. It checks the .nds header, maps either the ARM9 or the ARM7 binary at its RAM address together with the console's memory regions and I/O register labels, decompresses SDK-compressed ARM9 code and overlays, and fills the overlays the user selects at import, while an optional overlay-manager plugin swaps overlays in and out afterwards. The repository also keeps a small Ghidra Function ID database of NitroSDK 3.0 routines for function identification.","description_zh":"面向 Nintendo DS 程序的 Ghidra 加载器与插件。它校验 .nds 文件头，把 ARM9 或 ARM7 二进制映射到其内存地址，并建立主机的内存区域和 I/O 寄存器标签；经 SDK 压缩的 ARM9 代码和覆盖模块（overlay）会被解压，导入时用户选中的覆盖模块会载入内容，可选的覆盖模块管理插件还能在导入后切换各覆盖模块。仓库另附一个小型 Ghidra Function ID 数据库，收录 NitroSDK 3.0 例程，用于识别函数。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-20"},{"id":"bosectl-bose-bmap-protocol-case","name":"bosectl: reconstructing Bose’s BMAP headphone protocol","name_zh":"bosectl：重建 Bose BMAP 耳机协议","url":"https://github.com/aaronsb/bosectl","evidence_url":"https://github.com/aaronsb/bosectl/blob/70570b29c1d3c9ba775b08a29eaea72385de27b5/README.md","description_en":"Controls Bose headphones from Linux and macOS without the Bose app, account or cloud, through Python, Rust and C++ libraries and command-line tools that implement Bose’s BMAP protocol over Bluetooth RFCOMM. The author documents BMAP’s function blocks, operators, payload layouts and error codes in NOTES.md, reportedly worked out by probing RFCOMM channels, capturing Bluetooth traffic while changing settings in the Bose app and testing each operator, and the libraries cover noise cancellation, EQ, spatial audio, button remapping, profiles and device settings. Support is reported per model by the author and contributors.","description_zh":"无需 Bose 应用、账号或云服务，即可在 Linux 和 macOS 上控制 Bose 耳机：项目提供 Python、Rust 和 C++ 库及命令行工具，在蓝牙 RFCOMM 上实现 Bose 的 BMAP 协议。作者在 NOTES.md 中记录了 BMAP 的功能块、操作符、载荷布局和错误码，据称是通过探测 RFCOMM 通道、在 Bose 应用中更改设置时抓取蓝牙通信并逐一测试各操作符得出的；这些库涵盖降噪、均衡器、空间音频、按键重映射、配置档和设备设置。各型号的支持情况由作者和贡献者报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-20"},{"id":"mgbdis","name":"mgbdis","name_zh":"mgbdis Game Boy ROM 反汇编器","url":"https://github.com/mattcurrie/mgbdis","evidence_url":"https://github.com/mattcurrie/mgbdis/blob/95d951a9881a0d7ff1a42a94d1be175da92b1777/README.md","description_en":"Python disassembler that turns a Game Boy or Game Boy Color ROM, including multi-bank ROMs, into RGBDS-compatible assembly plus a Makefile that reassembles it, so the rebuilt ROM can be compared with the input. An optional .sym file beside the ROM supplies labels and marks code, data, text, padding and 1bpp/2bpp tile-image blocks; images are written as PNG files that rgbgfx converts back, text can use custom character maps, and hardware registers get hardware.inc names. The README explains that SM83 instructions vary in length and data is interleaved with code, so marked code blocks keep it from disassembling mid-instruction.","description_zh":"用 Python 编写的反汇编器，可把 Game Boy 或 Game Boy Color ROM（包括多存储体 ROM）转换为与 RGBDS 兼容的汇编代码，并生成用于重新汇编的 Makefile，以便将重建出的 ROM 与输入文件比对。ROM 旁可放置同名 .sym 文件，用来提供标签，并标出代码、数据、文本、填充以及 1bpp/2bpp 图块图像区段；图像会输出为 PNG，再由 rgbgfx 转换回去，文本可使用自定义字符映射，硬件寄存器则采用 hardware.inc 中的名称。README 解释说，SM83 指令长度不一，且数据与代码交错存放，因此需要标出代码区段，避免从指令中间开始反汇编。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-27"},{"id":"simba-mba-simplifier","name":"SiMBA","name_zh":"SiMBA 线性 MBA 表达式化简工具","url":"https://github.com/DenuvoSoftwareSolutions/SiMBA","evidence_url":"https://github.com/DenuvoSoftwareSolutions/SiMBA/blob/228179970f5906ed763afb33fc8649de2846696e/README.md","description_en":"Research tool from Denuvo that simplifies linear mixed Boolean-arithmetic (MBA) expressions, which combine bitwise and integer operations and are used in code obfuscation. Like MBA-Blast and MBA-Solver it works algebraically, using the fact that a linear MBA is fully determined by its values on inputs of zeros and ones: it evaluates the expression on every such combination and rewrites it as a linear combination of basic bitwise expressions, without first translating it to 1-bit space. Python scripts simplify single expressions or whole datasets, can check that an input is linear and can prove the result equivalent with Z3.","description_zh":"Denuvo 发布的研究工具，用于化简线性混合布尔-算术（MBA）表达式；这类表达式混合使用位运算和整数运算，常见于代码混淆。它与 MBA-Blast、MBA-Solver 一样采用纯代数方法，依据线性 MBA 完全由其在 0/1 输入上的取值决定这一性质：对所有 0/1 输入组合求值，再把表达式改写为基本位运算表达式的线性组合，而无需先转换到 1 位空间。所附 Python 脚本可化简单个表达式或整个数据集，可检查输入是否为线性 MBA，并可用 Z3 证明结果与原式等价。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"ghidra-allegrex","name":"ghidra-allegrex","name_zh":"ghidra-allegrex PSP Allegrex 处理器模块","url":"https://github.com/kotcrab/ghidra-allegrex","evidence_url":"https://github.com/kotcrab/ghidra-allegrex/blob/abcf97659260b11a9a4781ff72fff30ede2f073f/README.md","description_en":"Ghidra processor module for the Allegrex CPU of the PlayStation Portable, derived from Ghidra's MIPS module. It adds Allegrex-specific instructions, VFPU disassembly and basic decompilation, the PSP calling convention, and an ELF loader that detects PSP executables and applies the PSP-specific type A and B relocation sections, with rebasing after import. Bundled scripts import and export PPSSPP .sym function-label files, and an exporter writes kernel modules as relocatable object files for linking.","description_zh":"面向 PlayStation Portable 所用 Allegrex CPU 的 Ghidra 处理器模块，由 Ghidra 的 MIPS 模块衍生而来。它补充了 Allegrex 特有指令、VFPU 指令的反汇编与基础反编译、PSP 调用约定，以及可识别 PSP 可执行文件的 ELF 加载器；加载器会处理 PSP 特有的 A 类和 B 类重定位节，并支持导入后重新设定基址。附带的脚本可导入和导出 PPSSPP 的 .sym 函数标签文件，另有导出器可把内核模块写成可供链接的可重定位目标文件。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware","game"],"verified_at":"2026-10-27"},{"id":"frida-boot-workshop","name":"Frida Boot: a beginner binary instrumentation workshop","name_zh":"Frida Boot：二进制插桩入门工作坊","url":"https://github.com/leonjza/frida-boot","evidence_url":"https://github.com/leonjza/frida-boot/blob/73d1adf76275dd20a3da81bbc310cae58db78bfb/README.md","description_en":"A beginner workshop by leonjza on binary instrumentation with Frida, served as offline pages from a Docker container that has gdb with GEF and frida-tools preinstalled. Three chapters move from a small Linux C program, LD_PRELOAD hooks and how library calls resolve through the PLT and GOT, to Frida’s Interceptor for reading arguments and changing return values, NativeFunction for calling a program’s own functions, Python injector tools, RPC exports, TypeScript agents, frida-server and frida-gadget. It deliberately leaves out Frida’s mobile-app uses, and every exercise targets sample programs shipped with the workshop.","description_zh":"leonjza 编写的 Frida 二进制插桩入门工作坊，课程页面由一个 Docker 容器离线提供，容器内已预装带 GEF 的 gdb 和 frida-tools。三个章节从一个小型 Linux C 程序、LD_PRELOAD 钩子以及库函数调用如何经由 PLT 和 GOT 解析讲起，再到用 Frida 的 Interceptor 读取参数和修改返回值、用 NativeFunction 调用程序自身的函数、编写 Python 注入工具、RPC 导出、TypeScript 代理，以及 frida-server 和 frida-gadget。课程有意不涉及 Frida 在移动应用上的用法，所有练习都针对工作坊自带的示例程序。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-20"},{"id":"mcp-server-idapro-fdrechsler","name":"IDA Pro MCP Server (fdrechsler)","name_zh":"IDA Pro MCP 服务器（fdrechsler）","url":"https://github.com/fdrechsler/mcp-server-idapro","evidence_url":"https://github.com/fdrechsler/mcp-server-idapro/blob/6f960148a7a5def5a895ec7a31e7e80567bb215e/README.md","description_en":"An IDA Pro plugin and a TypeScript MCP server by Florian Drechsler: the plugin starts an HTTP server inside IDA on 127.0.0.1:9045, and the stdio MCP server forwards agent requests to it. Its twelve tools run IDAPython scripts passed inline or by file path, list functions, exports and strings, search names, immediate values and byte sequences, return cross-references to and from an address, and disassemble address ranges. It is a separate codebase from the mrexodia and Hex-Rays IDA MCP servers listed here.","description_zh":"由 Florian Drechsler 编写，包含一个 IDA Pro 插件和一个 TypeScript MCP 服务器：插件在 IDA 内的 127.0.0.1:9045 启动 HTTP 服务，stdio 方式运行的 MCP 服务器把智能体请求转发给它。其 12 个工具可执行以内联代码或文件路径传入的 IDAPython 脚本，列出函数、导出项和字符串，搜索名称、立即数和字节序列，返回某地址的入向与出向交叉引用，并反汇编指定地址范围。它与本合集已收录的 mrexodia 版和 Hex-Rays 官方 IDA MCP 服务器是不同的代码库。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-27"},{"id":"ghidra-headless-mcp","name":"Ghidra Headless MCP","name_zh":"Ghidra Headless MCP","url":"https://github.com/mrphrazer/ghidra-headless-mcp","evidence_url":"https://github.com/mrphrazer/ghidra-headless-mcp/blob/307b461cdbbedfbafb3771333f21875b745f940e/README.md","description_en":"Headless-only MCP server that drives Ghidra through PyGhidra and is meant to share a container with the agent rather than attach to a Ghidra GUI. Its 212 tools in 34 groups cover program and project lifecycle, disassembly, decompilation and P-code, patching and memory edits, symbols, references, types and structure layouts, search and graph extraction, with raw Python, Java-API and script access for anything else. Programs open read-only by default, edits run in transactions with undo and redo, a fake backend lets development and CI run without Ghidra, and a ghidra_cli client exposes the same tools to shells and agents without MCP.","description_zh":"仅以无界面方式运行的 MCP 服务器，通过 PyGhidra 驱动 Ghidra，设计为与智能体运行在同一容器中，而不是连接 Ghidra 图形界面。其 34 组共 212 个工具涵盖程序与项目生命周期、反汇编、反编译与 P-code、补丁与内存修改、符号、引用、类型与结构布局、搜索和图提取，其他需求可通过直接执行 Python、调用 Java API 或运行脚本完成。程序默认以只读方式打开，修改在支持撤销与重做的事务中进行；伪后端让开发和 CI 无需安装 Ghidra 即可运行，ghidra_cli 客户端则把同一套工具提供给不使用 MCP 的命令行和智能体。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-20"},{"id":"binary-ninja-headless-mcp","name":"Binary Ninja Headless MCP","name_zh":"Binary Ninja Headless MCP（无界面）","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp","evidence_url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/README.md","description_en":"A third-party, headless-only MCP server by Ruben Marks (mrphrazer) that gives agents a large Binary Ninja tool surface the project counts as 181 tools across 36 feature groups, including disassembly, intermediate languages, cross-references, types, search, patching with undo/redo transactions, and arbitrary scripting through binja.eval and binja.call. It speaks MCP over stdio or TCP, ships a schema-derived command-line client (binja_cli), and is meant to run in the same container as the agent runtime. A fake-backend mode runs the CLI, tests and a feature fuzzer without a Binary Ninja license, while real analysis needs a headless-capable license.","description_zh":"Ruben Marks（mrphrazer）开发的第三方、仅无界面运行的 MCP 服务器，向智能体提供庞大的 Binary Ninja 工具集，项目称共 181 个工具、分 36 个功能组，涵盖反汇编、中间语言、交叉引用、类型、搜索、带撤销/重做事务的打补丁，以及通过 binja.eval 和 binja.call 执行任意脚本。它通过 stdio 或 TCP 使用 MCP 协议，附带一个由模式生成参数的命令行客户端 binja_cli，设计上与智能体运行时位于同一容器内。假后端模式可在没有 Binary Ninja 许可证的情况下运行 CLI、测试和功能模糊器，实际分析则需要支持无界面模式的许可证。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-27"},{"id":"gm8decompiler","name":"GM8Decompiler","name_zh":"GM8Decompiler GameMaker 8 游戏反编译器","url":"https://github.com/OpenGMK/GM8Decompiler","evidence_url":"https://github.com/OpenGMK/GM8Decompiler/blob/4cf52818a303e51154e7dc0ec473a22d8c24f21e/README.org","description_en":"Command-line tool that turns games built with GameMaker 8.0 or 8.1 back into editable .gmk or .gm81 project files. It reads the gamedata section that a built executable carries next to the runner and writes its settings, sprites, sounds, backgrounds, paths, scripts, fonts, timelines, objects, rooms, extensions, included files and GML code in the project format matching the game's version. A Rust rewrite on the OpenGMK project's gm8exe library that replaced the team's fork of WastedMeerkat's gm81decompiler, it is now developed in the OpenGMK repository alongside the GM8Emulator runner reimplementation.","description_zh":"命令行工具，可把用 GameMaker 8.0 或 8.1 构建的游戏还原为可编辑的 .gmk 或 .gm81 项目文件。它读取已构建可执行文件中与运行器（runner）并存的 gamedata 部分，按游戏版本对应的项目格式写出其中的设置、精灵、声音、背景、路径、脚本、字体、时间线、对象、房间、扩展、附带文件以及 GML 代码。该工具基于 OpenGMK 项目的 gm8exe 库用 Rust 重写，取代了团队此前对 WastedMeerkat 的 gm81decompiler 的分支，现与重新实现 GameMaker 运行器的 GM8Emulator 一同在 OpenGMK 仓库中开发。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-27"},{"id":"uelib-unreal-package-library","name":"UELib (Unreal-Library)","name_zh":"UELib Unreal 包文件解析与反编译库","url":"https://github.com/EliotVU/Unreal-Library","evidence_url":"https://github.com/EliotVU/Unreal-Library/blob/8236c39b79e30887a487ecf9b018204e430a5ebc/README.md","description_en":"C# library that reads Unreal Engine 1, 2 and 3 package files such as .u, .upk and .udk, auto-detects a matching game build and deserializes their exports, imports and properties. Its main goal is decompiling UnrealScript bytecode back to source by reconstructing classes, states, functions, structs, enums and default properties; it also deserializes fonts, sounds, palettes and textures. The README’s per-game compatibility table runs from Unreal and Deus Ex to Splinter Cell, Mass Effect and the Batman: Arkham games, and the separate UE Explorer GUI is built on it.","description_zh":"读取 Unreal Engine 1、2、3 包文件（如 .u、.upk 和 .udk）的 C# 库，可自动识别匹配的游戏构建，并反序列化其中的导出、导入对象和属性。其主要目标是通过重建类、状态、函数、结构体、枚举和默认属性，把 UnrealScript 字节码反编译回源码；它也能反序列化字体、声音、调色板和纹理。README 中的逐游戏兼容表从 Unreal、Deus Ex 一直列到 Splinter Cell、Mass Effect 和 Batman: Arkham 系列，独立的 UE Explorer 图形界面即基于此库构建。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-20"},{"id":"mytechnotalent-embedded-hacking","name":"Embedded Hacking (mytechnotalent)","name_zh":"Embedded Hacking 嵌入式逆向课程（mytechnotalent）","url":"https://github.com/mytechnotalent/Embedded-Hacking","evidence_url":"https://github.com/mytechnotalent/Embedded-Hacking/blob/76fa253e9b54aba39b9b02d7738664a65864b425/README.md","description_en":"A free English course by mytechnotalent on developing, debugging and reverse engineering firmware for the Raspberry Pi Pico 2 (RP2350, Arm Cortex-M33). A fourteen-week syllabus with slides, Markdown notebooks and a 40-chapter PDF textbook follows a write, debug, then hack pattern from hello-world through variables, data types, constants, operators, conditionals, structures and functions, using GDB with OpenOCD and Ghidra, with Binary Ninja and IDA versions of the notebooks from week 4; an I2C LCD, GPS, LoRa radio, servo and IR remote supply the exercises. Graded CTFs, story-driven classified-brief challenges and a secure-boot custom bootloader ship as author-built binaries alongside their source.","description_zh":"mytechnotalent 编写的免费英文课程，讲解 Raspberry Pi Pico 2（RP2350，Arm Cortex-M33）固件的开发、调试与逆向。14 周的课程大纲配有幻灯片、Markdown 笔记和 40 章 PDF 教材，按“编写、调试、再破解”的模式，从 hello world 讲到变量、数据类型、常量、运算符、条件语句、结构体和函数，使用 GDB 配合 OpenOCD 以及 Ghidra，第 4 周起的笔记另有 Binary Ninja 和 IDA 版本；练习围绕 I2C LCD、GPS、LoRa 无线模块、舵机和红外遥控展开。计分 CTF、剧情式“机密简报”挑战和一个安全启动自定义引导程序均以作者构建的二进制文件形式提供，并附有源码。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["firmware"],"verified_at":"2026-10-20"},{"id":"apple-continuity-tools","name":"Apple Continuity Reverse Engineering Toolkit","name_zh":"Apple Continuity 逆向工程工具包","url":"https://github.com/seemoo-lab/apple-continuity-tools","evidence_url":"https://github.com/seemoo-lab/apple-continuity-tools/blob/b93207b5887c6bef8c9e0e16a442149fb3520e28/README.md","description_en":"Three macOS helpers from SEEMOO Lab that the Open Wireless Link project used to study Apple wireless services such as AirDrop, Wi-Fi Password Sharing, Handoff and Offline Finding from the host side. process_recon summarizes which processes, log categories and subsystems emit log entries matching chosen keywords; keychain_access uses Frida to hook SecItemCopyMatching in a process and exports the keychain items it accesses to JSON; and lldb breakpoint commands print the Handoff and Universal Clipboard messages that the rapportd daemon sends and receives.","description_zh":"SEEMOO 实验室的三个 macOS 辅助工具，Open Wireless Link 项目曾用它们从主机一侧研究 AirDrop、Wi-Fi 密码共享、Handoff 和离线查找等 Apple 无线服务。process_recon 汇总哪些进程、日志类别和子系统产生了含指定关键词的日志；keychain_access 借助 Frida 挂接某一进程中的 SecItemCopyMatching，把该进程访问的钥匙串条目导出为 JSON；另有一组 lldb 断点命令，可打印 rapportd 守护进程收发的 Handoff 与通用剪贴板消息。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-20"},{"id":"osmo-pocket-3-ble-protocol-case","name":"lib-osmo-ble: DJI Osmo Pocket 3 Bluetooth LE protocol library","name_zh":"lib-osmo-ble：DJI Osmo Pocket 3 低功耗蓝牙协议库","url":"https://github.com/yigitkonur/lib-osmo-ble","evidence_url":"https://github.com/yigitkonur/lib-osmo-ble/blob/021e96c2bec7e9a2a81296292545bc1ee432af49/README.md","description_en":"Reconstructs the DUML-over-BLE protocol that DJI's Mimo app uses with the Osmo Pocket 3 camera as a Node.js library and CLI for scanning, pairing, gimbal commands and roughly 20 Hz position telemetry without the vendor app. The author reports working from a third party's Wireshark captures and dissector of Mimo traffic, a Go client and trial-and-error debugging; PROTOCOL.md documents the frame layout, CRC parameters, BLE characteristic roles and command IDs. A write-up and bundled patch trace seven bugs that kept the earlier node-osmo library from working with the camera, and the author reports that the patched library completed pairing, Wi-Fi setup and RTMP streaming.","description_zh":"重建 DJI Mimo 应用与 Osmo Pocket 3 相机之间基于 BLE 的 DUML 协议，提供 Node.js 库和命令行工具，无需官方应用即可扫描、配对、发送云台指令并接收约 20 Hz 的姿态遥测。作者称其依据第三方对 Mimo 通信的 Wireshark 抓包与解析器、一个 Go 客户端以及反复试验调试完成；PROTOCOL.md 记录了帧结构、CRC 参数、BLE 特征值的用途和命令 ID。一篇过程记录和随附补丁梳理了导致早期 node-osmo 库无法配合该相机工作的七个缺陷，作者报告打过补丁的库完成了配对、Wi-Fi 设置和 RTMP 推流。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"uefi-retool","name":"uefi_retool","name_zh":"uefi_retool UEFI 固件逆向工具","url":"https://github.com/yeggor/uefi_retool","evidence_url":"https://github.com/yeggor/uefi_retool/blob/be13abf0a84179f53a9ac8858a4cb2686b312a67/README.md","description_en":"Python command-line tool and IDA Pro plugin for UEFI firmware reverse engineering. uefi_retool.py unpacks a firmware image with uefi-firmware-parser, collects its executable modules and runs IDA in batch mode on each one, writing their boot-service calls and protocol GUIDs to JSON; a separate command lists protocols whose GUIDs are absent from its EDK2, AMI and vendor GUID tables as proprietary. Inside IDA the plugin applies EFI system-table types and names, lists protocols in an explorer window and, from the JSON, shows a dependency browser and graph across the firmware’s modules.","description_zh":"用于 UEFI 固件逆向工程的 Python 命令行工具及 IDA Pro 插件。uefi_retool.py 用 uefi-firmware-parser 解包固件镜像，收集其中的可执行模块，并以批处理模式逐一交给 IDA 分析，把各模块的引导服务调用和协议 GUID 写入 JSON；另一条命令则把 GUID 不在其 EDK2、AMI 及厂商 GUID 表中的协议列为专有协议。在 IDA 中，插件会应用 EFI 系统表的类型和名称，在浏览窗口中列出协议，并根据该 JSON 展示固件各模块之间的依赖浏览器和依赖图。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"gtirb","name":"GTIRB","name_zh":"GTIRB 二进制中间表示","url":"https://github.com/GrammaTech/gtirb","evidence_url":"https://github.com/GrammaTech/gtirb/blob/98fececb52ba36d86fe6798303a1904574dd5bb6/README.md","description_en":"GrammaTech's intermediate representation for passing disassembly, analysis and rewriting results between binary tools, modeled on the role LLVM-IR plays for compilers. An IR holds modules for executables or libraries with their sections, byte intervals, code and data blocks, symbols and symbolic operands, plus an inter-procedural CFG and AuxData tables for analysis results, all referenced by UUID; instruction semantics are deliberately left out, so machine code stays as raw bytes for Capstone/Keystone or any other IL. It serializes as protobuf, with C++, Python and Common Lisp APIs and a partial Java API; the separately listed ddisasm produces it.","description_zh":"GrammaTech 开发的二进制中间表示，用于在各类二进制工具之间传递反汇编、分析与改写结果，其定位参照 LLVM-IR 在编译器中的作用。一个 IR 包含代表可执行文件或库的模块及其节、字节区间、代码块与数据块、符号和符号化操作数，另有过程间控制流图和存放分析结果的 AuxData 表，所有元素都通过 UUID 引用；它刻意不表示指令语义，机器码以原始字节保存，可交由 Capstone/Keystone 或其他中间语言处理。GTIRB 以 protobuf 序列化，提供 C++、Python 和 Common Lisp API 以及不完整的 Java API；另行收录的 ddisasm 可生成这种表示。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"quokka-binary-exporter","name":"Quokka","name_zh":"Quokka 二进制导出工具","url":"https://github.com/quarkslab/quokka","evidence_url":"https://github.com/quarkslab/quokka/blob/5afe14bd424835431bbd8015f061a9b551608af4/README.md","description_en":"Quarkslab’s binary exporter, inspired by BinExport, saves a disassembler’s analysis to a protobuf .quokka file so functions, basic blocks, data, cross-references, segments and optionally decompiled code can be used later without the disassembler. Its Python bindings load an export together with the original binary, decode instructions at runtime with Capstone, or optionally lift them to P-code with pypcode, and expose programs, functions and control-flow graphs through one API. The main branch adds Ghidra and Binary Ninja exporters beside the IDA Pro plugin, a parallel quokka-cli batch exporter and name and type edits that can be written back to an IDA database.","description_zh":"Quarkslab 的二进制导出工具，受 BinExport 启发，把反汇编器的分析结果保存为 protobuf 格式的 .quokka 文件，此后无需反汇编器即可使用其中的函数、基本块、数据、交叉引用、段以及可选的反编译代码。其 Python 绑定将导出文件与原始二进制一并载入，运行时用 Capstone 解码指令，也可选用 pypcode 将其提升为 P-code，并通过统一的 API 提供程序、函数和控制流图。main 分支在 IDA Pro 插件之外新增了 Ghidra 与 Binary Ninja 导出器、可并行批量导出的 quokka-cli，以及可写回 IDA 数据库的名称和类型编辑。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"knife","name":"knife","name_zh":"knife 静态逆向工程工具包","url":"https://github.com/bl4ckr0ss3/knife","evidence_url":"https://github.com/bl4ckr0ss3/knife/blob/f260b87ffc54ae5c8c56cc31351334d209228745/README.md","description_en":"Static reverse-engineering toolkit in Rust, installed as the knife command, that parses PE, ELF, Mach-O and WebAssembly files without running them. It triages hashes, sections, mitigations, imports, strings, indicators and crypto constants; recovers functions, call graphs and CFGs through recursive-descent disassembly for x86/x64 and AArch64; and lifts functions to experimental pseudocode. Analysts' names, notes, types and staged patches persist in a per-binary database shared by the CLI, a terminal UI and an MCP server, and further passes rank risky API call sites by argument provenance and summarize Windows driver dispatch and IOCTL surfaces.","description_zh":"以 Rust 编写的静态逆向工程工具包，安装后为 knife 命令，可在不运行目标的情况下解析 PE、ELF、Mach-O 和 WebAssembly 文件。它能分诊哈希、节区、缓解措施、导入、字符串、威胁指标和加密常量；通过面向 x86/x64 与 AArch64 的递归下降反汇编恢复函数、调用图和控制流图；还能把函数提升为实验性伪代码。分析者添加的命名、注释、类型和暂存补丁保存在按二进制区分的数据库中，由命令行、终端界面和 MCP 服务器共享；另有分析步骤按参数来源对有风险的 API 调用点排序，并汇总 Windows 驱动的派发例程和 IOCTL 接口。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"interactive-ida-plugin-list","name":"Interactive IDA Plugin List","name_zh":"交互式 IDA 插件清单","url":"https://github.com/vmallet/ida-plugins","evidence_url":"https://github.com/vmallet/ida-plugins/blob/825941fe4eea969fc5909bb790e3e2cc9a86e082/README-template.md","description_en":"A sortable, filterable list of 618 plugins, loaders, processor modules and scripts for Hex-Rays' IDA Pro, published as a GitHub Pages table with a static copy generated into the README. Each entry links to its project, almost always on GitHub, with a short description and, where recorded, its language (C++ or Python), category tags such as decompiler, deobfuscation, loader, debug or integration, and the date the project was last updated. The list grew out of onethawt's idaplugins-list of about 200 plugins.","description_zh":"可排序、可筛选的 Hex-Rays IDA Pro 插件清单，收录 618 个插件、加载器、处理器模块和脚本，以 GitHub Pages 表格发布，并在 README 中生成静态副本。每个条目链接到对应项目（几乎都在 GitHub 上），附简短说明；如有记录，还标出实现语言（C++ 或 Python）、反编译器、反混淆、加载器、调试、集成等分类标签，以及项目的最近更新日期。该清单由 onethawt 约 200 个插件的 idaplugins-list 扩展而来。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-27"},{"id":"ida-skill-malware-analysis","name":"IDA-Skill","name_zh":"IDA-Skill IDA Pro 恶意样本分析智能体技能","url":"https://github.com/miunasu/IDA-Skill","evidence_url":"https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/README_EN.md","description_en":"Agent skill that has an AI agent triage malware samples statically in IDA Pro through headless idat. An initialization script builds the IDA database and exports a summary, imports, exports, entry-point decompilation and filtered strings, and an executor runs IDAPython snippets or files against that database. SKILL.md sets a static-only rule, a top-down method and a rule to hand large string dumps to a sub-agent, and bundled scripts add cryptographic-constant detection, an export-size check and REAI, which sends decompiled functions to a configured OpenAI-compatible model to describe them and rename them with an AI_ prefix.","description_zh":"一个智能体技能，让 AI 智能体通过无界面的 idat 在 IDA Pro 中对恶意样本进行静态初步分析。初始化脚本会生成 IDA 数据库，并导出基本信息、导入表、导出表、入口点反编译结果和过滤后的字符串；执行脚本则可对该数据库运行 IDAPython 代码片段或脚本文件。SKILL.md 规定只做静态分析、采用自顶向下的分析方法，并要求把大型字符串列表交给子智能体处理；附带脚本提供加密常量识别、导出函数大小检查，以及 REAI——它把反编译出的函数发送给配置好的 OpenAI 兼容模型，生成功能说明并以 AI_ 前缀重命名。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-27"},{"id":"cobra-irad-bluetooth-protocol-walkthrough","name":"Reverse-Engineering a Bluetooth-Enabled Radar Detector","name_zh":"逆向分析蓝牙雷达测速预警器协议","url":"https://github.com/brandonasuncion/Reverse-Engineering-Bluetooth-Protocols","evidence_url":"https://github.com/brandonasuncion/Reverse-Engineering-Bluetooth-Protocols/blob/daf7c5c4b9d0d11eed45371324cf368c8bad9703/README.md","description_en":"Write-up of how the author decoded the Bluetooth RFCOMM protocol of a Cobra iRAD 900 radar detector so that a Raspberry Pi 3 could receive alerts without the iOS or Android app. Traffic was logged on a jailbroken iPhone with BTServer and filtered in Wireshark; the README then documents the detector's half-second status payload and the 9-byte reply whose ACK byte must echo the detector's sequence byte, and replays recorded responses to the initial settings sync instead of decoding it. A short beginner's case study on RFCOMM traffic analysis with a rough proof-of-concept script, not a maintained client.","description_zh":"作者记录了如何解析 Cobra iRAD 900 雷达测速预警器的蓝牙 RFCOMM 协议，使 Raspberry Pi 3 无需 iOS 或 Android 应用即可接收警报。作者在越狱 iPhone 上用 BTServer 记录通信，再用 Wireshark 过滤；README 随后说明预警器每半秒发送的状态载荷，以及 9 字节的回复报文，其中 ACK 字节必须回显预警器发来的序号字节；对于连接初期的设置同步，则直接重放录制的响应而不加解析。这是一个面向初学者的 RFCOMM 流量分析简短案例，附带粗略的概念验证脚本，并非持续维护的客户端。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"barf","name":"BARF","name_zh":"BARF 二进制分析与逆向工程框架","url":"https://github.com/programa-stic/barf-project","evidence_url":"https://github.com/programa-stic/barf-project/blob/9547ef843b8eb021c2c32c140e36173c0b4eafa3/README.md","description_en":"Python binary analysis framework that loads ELF and PE programs, disassembles 32- and 64-bit x86 and 32-bit ARM code with Capstone and translates it into the REIL intermediate language, so its analyses do not depend on the source architecture. Modules recover control-flow and call graphs, emulate REIL and turn code fragments into Z3 or CVC4 formulas for checking constraints on registers and memory; release 0.6.0 added basic symbolic execution. Bundled command-line tools recover CFGs and call graphs, replay x86 execution traces and search, classify and verify ROP gadgets.","description_zh":"一个 Python 二进制分析框架：加载 ELF 和 PE 程序，借助 Capstone 反汇编 32 位与 64 位 x86 及 32 位 ARM 代码，并将其翻译为 REIL 中间语言，使各项分析不依赖源架构。其模块可恢复控制流图和调用图、模拟执行 REIL，并把代码片段转换为 Z3 或 CVC4 公式，以检查寄存器和内存上的约束；0.6.0 版加入了基础的符号执行。随附的命令行工具可恢复 CFG 和调用图、重放 x86 执行轨迹，以及搜索、分类和验证 ROP gadget。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"cbyge-c-by-ge-protocol-case","name":"cbyge: reconstructing the C by GE smart-bulb cloud protocol","name_zh":"cbyge：重建 C by GE 智能灯泡云端协议","url":"https://github.com/unixpickle/cbyge","evidence_url":"https://github.com/unixpickle/cbyge/blob/459be53a48ca75f543f9367094b778559403c1bf/README.md","description_en":"Reimplements the cloud control path of the C by GE (now Cync) smart-bulb app as a Go library and a small self-hosted web app. The author reports decompiling the Android app with Apktool, finding its JSON HTTP API for login and device lists and a separate raw TCP protocol to the vendor's server, then working out that protocol's type-and-length message framing and packet encodings from proxied traffic and the Smali code. The resulting API lists devices, reads their status and sets power, brightness, color tone and RGB color.","description_zh":"以 Go 库和一个可自行部署的小型网页应用，重新实现 C by GE（现名 Cync）智能灯泡应用的云端控制通道。作者称先用 Apktool 反编译 Android 应用，找到用于登录和设备列表的 JSON HTTP 接口，以及另一条连接厂商服务器的原始 TCP 协议，再结合代理记录的通信和 Smali 代码，推断出该协议以类型和长度开头的消息格式及各类数据包编码。最终的 API 可列出设备、读取状态，并设置开关、亮度、色温和 RGB 颜色。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-27"},{"id":"shannon-modem-loader","name":"Shannon Modem Loader for IDA Pro","name_zh":"Shannon 基带镜像 IDA Pro 加载器","url":"https://github.com/alexander-pick/shannon_modem_loader","evidence_url":"https://github.com/alexander-pick/shannon_modem_loader/blob/2dc27f01782eaaa55ef626e15ef6b4154bf0e392/README.md","description_en":"IDA Pro loader and post-processing scripts for Samsung Exynos \"Shannon\" baseband modem images that carry a TOC header, including crash dumps. The loader maps the TOC entries to aligned segments and entry points; after auto-analysis the post-processor restores debug-trace structures, names functions from strings and debug-log calls, rebuilds the MPU table and memory map, comments MMU-related coprocessor instructions, performs the ARM scatter-load with its decompression, and labels platform-abstraction-layer and task-initialization functions. The README adds the author's notes on ShannonOS, the PAL and the move from Cortex-R to Cortex-A cores.","description_zh":"用于 IDA Pro 的加载器和后处理脚本，处理带 TOC 头的三星 Exynos“Shannon”基带调制解调器镜像，也支持崩溃转储。加载器把 TOC 条目映射为对齐的段并设置入口点；自动分析完成后，后处理程序会恢复调试跟踪结构，依据字符串和调试日志调用为函数命名，重建 MPU 表和内存映射，为 MMU 相关的协处理器指令添加注释，执行 ARM 分散加载及其解压，并标注平台抽象层与任务初始化函数。README 还附有作者对 ShannonOS、PAL 以及从 Cortex-R 转向 Cortex-A 内核的说明。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"rabbitizer","name":"rabbitizer","name_zh":"rabbitizer MIPS 指令解码器","url":"https://github.com/Decompollaborate/rabbitizer","evidence_url":"https://github.com/Decompollaborate/rabbitizer/blob/724a49a5b4dbfb99f1a9e6992e63964fd29c90c8/README.md","description_en":"MIPS instruction decoder written in C that never allocates on the heap, with Python, C++ and Rust bindings in the same repository and the stated aim of producing matching assembly. It decodes one instruction word at a time, focusing on MIPS I to III with partial MIPS IV support, and also handles the N64 RSP, the PlayStation's R3000 GTE, the PSP's R4000 Allegrex and the PS2's R5900; it offers validation checks, instruction-grouping queries, configurable pseudo-instructions and register names, and small helpers for building pointer and symbol detection. Matching-decompilation tooling builds on it: splat and spimdisasm both list it as a Python dependency.","description_zh":"使用 C 编写、完全不在堆上分配内存的 MIPS 指令解码器，同一仓库还提供 Python、C++ 和 Rust 绑定，目标是生成可匹配的汇编。它逐条解码指令字，重点支持 MIPS I 至 III，部分支持 MIPS IV，还能处理 N64 的 RSP、PlayStation 的 R3000 GTE、PSP 的 R4000 Allegrex 以及 PS2 的 R5900；提供指令有效性检查、按特征分组查询指令、可配置的伪指令与寄存器命名，以及用于自建指针和符号检测的小工具。匹配式反编译工具以它为基础：splat 和 spimdisasm 都把它列为 Python 依赖。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-27"},{"id":"echomuse-echo-dot-voice-satellite-case","name":"EchoMuse: replacement software that turns the Echo Dot 2nd gen into a Home Assistant voice satellite","name_zh":"EchoMuse：把第二代 Echo Dot 变成 Home Assistant 语音终端的替换软件","url":"https://github.com/wilbowes/EchoMuse","evidence_url":"https://github.com/wilbowes/EchoMuse/blob/4bbf7ff6eb9c97faea9080e0a2a6032921ef8108/README.md","description_en":"Replaces the software on an unlocked second-generation Amazon Echo Dot (2016, codename biscuit) so it works as a local Home Assistant voice satellite over the ESPHome API: EchoMuse's own Go firmware drives the microphones, speaker, LED ring and buttons, and a controller on the LAN handles wake words, devices and a dashboard. Its default emOS mode swaps Amazon's Android userspace for the project's own init and busybox while keeping the Dot's kernel from the owner's boot image. An engineering journal records how codec routes, the mute key and other hardware behavior were worked out by measuring the device and diffing the mixer and DAPM state while stock FireOS plays a sound.","description_zh":"替换已解锁的第二代 Amazon Echo Dot（2016 年款，代号 biscuit）上的软件，使其通过 ESPHome API 成为本地 Home Assistant 语音终端：EchoMuse 自己的 Go 固件驱动麦克风、扬声器、LED 灯环和按键，局域网中的控制器负责唤醒词、设备管理和仪表盘。默认的 emOS 模式用项目自有的 init 和 busybox 取代 Amazon 的 Android 用户空间，同时保留取自机主自身启动镜像的 Dot 内核。工程日志记录了如何通过在设备上测量，并在原厂 FireOS 播放声音时对比混音器和 DAPM 状态，摸清编解码器通路、静音键等硬件行为。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"ghidrecomp","name":"ghidrecomp","name_zh":"ghidrecomp 命令行 Ghidra 批量反编译工具","url":"https://github.com/clearbluejar/ghidrecomp","evidence_url":"https://github.com/clearbluejar/ghidrecomp/blob/7a82556b052268a53c734a769bd14eeabc1a4888/README.md","description_en":"Python command-line decompiler that drives Ghidra through pyghidra to decompile every function of a binary into separate C files, or into one C file and header with Ghidra's C++ exporter, keeping the Ghidra project so later runs can reuse the analysis. Options filter functions by regex, apply PDB symbols from a local file or from Microsoft, Chromium, Mozilla, Intel, NVIDIA and AMD symbol servers, apply extra GDT data-type archives, write Mermaid call-graph Markdown, generate BSim function signatures, and scan the decompiled code with Semgrep rules into SARIF reports.","description_zh":"通过 pyghidra 驱动 Ghidra 的 Python 命令行反编译工具：把二进制中的所有函数分别反编译为独立的 C 文件，或借助 Ghidra 的 C++ 导出器生成一个 C 文件和头文件，并保留 Ghidra 项目以便后续运行复用分析结果。可按正则筛选函数，从本地文件或 Microsoft、Chromium、Mozilla、Intel、NVIDIA、AMD 符号服务器应用 PDB 符号，加载额外的 GDT 数据类型库，输出 Mermaid 调用图 Markdown，生成 BSim 函数签名，并用 Semgrep 规则扫描反编译代码、输出 SARIF 报告。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"arkdecompiler","name":"arkdecompiler","name_zh":"arkdecompiler 鸿蒙 NEXT 反编译器","url":"https://github.com/jd-opensource/arkdecompiler","evidence_url":"https://github.com/jd-opensource/arkdecompiler/blob/8afb36903127b56edee362ce67aacd823610d3e4/README.md","description_en":"Decompiler for HarmonyOS NEXT apps, published under the jd-opensource GitHub organization, that turns Panda binary files (.abc Ark bytecode) back into ArkTS source. Its xabc program parses the bytecode, lifts it into the Ark compiler's Panda IR for analysis, rebuilds an ArkTS syntax tree with loop, class, lexical-environment and module-variable reconstruction, and prints that tree as ArkTS code. A cross-platform GUI, built with either Electron or Tauri, adds a file explorer, function and symbol lists, cross-references, search and a hex view; the README links Black Hat Arsenal presentations from 2025 and 2026.","description_zh":"面向 HarmonyOS NEXT（纯血鸿蒙）应用的反编译器，发布于 jd-opensource GitHub 组织下，可将 Panda 二进制文件（.abc 方舟字节码）还原为 ArkTS 源码。其 xabc 程序解析字节码，将其提升为方舟编译器的 Panda IR 以便分析，再通过循环、类、词法环境和模块变量的重建生成 ArkTS 语法树，最后输出为 ArkTS 代码。跨平台图形界面可基于 Electron 或 Tauri 构建，提供文件浏览、函数与符号列表、交叉引用、搜索和十六进制视图；README 链接了 2025 年和 2026 年的 Black Hat Arsenal 展示。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"vivisect","name":"Vivisect","name_zh":"Vivisect 二进制分析与调试框架","url":"https://github.com/vivisect/vivisect","evidence_url":"https://github.com/vivisect/vivisect/blob/66c93f0c1caa949434b9b1ba8bb64c8bad0eb3d9/README.md","description_en":"Pure-Python reverse-engineering framework that combines the vivisect static analyzer, the vtrace debugging library and the vdb debugger. Vivisect loads PE, ELF, Mach-O, Intel HEX, S-record and raw blob files into workspaces, disassembles and emulates code through envi architecture modules for x86, AMD64, ARM, Thumb, AArch64, MSP430, H8 and Z80, and adds symbolic execution, a Qt GUI and a remote workspace server. vtrace drives processes on Windows, Linux, FreeBSD, macOS and Solaris and has GDB-stub and VMware backends.","description_zh":"纯 Python 编写的逆向工程框架，集成了 vivisect 静态分析器、vtrace 调试库和 vdb 调试器。Vivisect 可将 PE、ELF、Mach-O、Intel HEX、S-record 和原始数据块文件载入工作区，借助 envi 架构模块对 x86、AMD64、ARM、Thumb、AArch64、MSP430、H8 和 Z80 代码进行反汇编和模拟执行，并提供符号执行、Qt 图形界面和远程工作区服务器。vtrace 可在 Windows、Linux、FreeBSD、macOS 和 Solaris 上控制进程，另有 GDB stub 和 VMware 后端。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-27"},{"id":"jnianalyzer","name":"JNIAnalyzer","name_zh":"JNIAnalyzer Ghidra 扩展","url":"https://github.com/Ayrx/JNIAnalyzer","evidence_url":"https://github.com/Ayrx/JNIAnalyzer/blob/7170ce6bd138caa6be702e357b3aeb74231ae12f/README.md","description_en":"A Ghidra extension by Terry Chia (Ayrx) with scripts for analyzing the native libraries of Android NDK apps. JNIAnalyzer.java uses the bundled JADX decompiler to extract the signatures of all native methods declared in an APK and applies the return types, parameter names and parameter types to the matching functions in the loaded .so. RegisterNatives.java uses Ghidra's P-Code API to find RegisterNatives calls and lay down the JNINativeMethod structures for dynamically registered methods, and TraceRegisterNatives.java applies the output of the author's trace_registernatives tool. A JNI data-type archive sets up the jni.h types.","description_zh":"Terry Chia（Ayrx）编写的 Ghidra 扩展，包含用于分析 Android NDK 应用原生库的脚本。JNIAnalyzer.java 使用随附的 JADX 反编译器从 APK 中提取所有原生方法的签名，并把返回类型、参数名和参数类型应用到已加载 .so 中的匹配函数。RegisterNatives.java 借助 Ghidra 的 P-Code API 查找 RegisterNatives 调用，为动态注册的方法铺设 JNINativeMethod 结构；TraceRegisterNatives.java 则应用作者 trace_registernatives 工具的输出。随附的 JNI 数据类型归档用于设置 jni.h 类型。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-27"},{"id":"imsprog","name":"IMSProg","name_zh":"IMSProg EEPROM／闪存芯片编程器","url":"https://github.com/bigbigmdm/IMSProg","evidence_url":"https://github.com/bigbigmdm/IMSProg/blob/a9c0a5d943e0f2d05a4012f215a2801a6c4d51e1/README.md","description_en":"Qt desktop programmer that reads, writes, erases and verifies I2C, SPI and MicroWire EEPROMs, FeRAM, DataFlash and SPI NOR/NAND flash chips through low-cost CH341A, CH347T and FT232H USB programmers. It identifies SPI flash by JEDEC ID against an editable chip database, shows SFDP, status and security registers, scans NAND bad blocks, and keeps the chip image in a hex-editor buffer that can save or load parts of the image and import or export Intel HEX. Companion programs edit the chip database and update it from the author's web server.","description_zh":"基于 Qt 的桌面编程器，通过低成本的 CH341A、CH347T 和 FT232H USB 编程器读取、写入、擦除和校验 I2C、SPI 与 MicroWire EEPROM、FeRAM、DataFlash 以及 SPI NOR/NAND 闪存芯片。它根据 JEDEC ID 在可编辑的芯片数据库中识别 SPI 闪存，显示 SFDP、状态寄存器和安全寄存器，可扫描 NAND 坏块，并把芯片镜像放在十六进制编辑缓冲区中，支持按区段保存或载入以及导入导出 Intel HEX。配套程序用于编辑芯片数据库，并从作者的网站更新数据库。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"rbasefind","name":"rbasefind","name_zh":"rbasefind 固件基址搜索工具","url":"https://github.com/sgayou/rbasefind","evidence_url":"https://github.com/sgayou/rbasefind/blob/a661118d19f0e2b282c48f2e8019d493868d4dd2/README.md","description_en":"Multithreaded Rust command-line tool that brute-forces the load address of a flat 32-bit firmware image, reimplementing mncoppola's basefind.py and rsaxvc's basefind.cpp. It records the offsets of ASCII strings, reads every 32-bit word as a possible pointer, and ranks candidate base addresses by how many strings each one would turn into pointer targets. The README calls it a simple heuristic that works rather well on some ARM (non-Thumb) binaries and will not work miracles.","description_zh":"一个多线程 Rust 命令行工具，以暴力搜索推算平面 32 位固件镜像的加载基址，是 mncoppola 的 basefind.py 和 rsaxvc 的 basefind.cpp 的重新实现。它记录 ASCII 字符串的偏移，把每个 32 位字都当作可能的指针，再按候选基址能让多少字符串成为指针目标来排序。README 称这只是一个简单的启发式方法，对部分 ARM（非 Thumb）二进制效果相当好，但不会创造奇迹。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"linkpi-encx-unofficial-docs","name":"Link Pi ENCx encoders (unofficial documentation)","name_zh":"Link Pi ENCx 编码器非官方逆向文档","url":"https://github.com/matiaspl/LinkPi-ENCx","evidence_url":"https://github.com/matiaspl/LinkPi-ENCx/blob/a30d20161f6d28805fbb2c040250a7145b5f6655/README.md","description_en":"A single-README notebook, kept since 2021 by an owner with no ties to the vendor, on the internals of LinkPi ENC-series video encoders and the TBS 2603SE, which share one firmware line; the author's first units use the F3520D board with a HiSilicon Hi3520DV400. It covers the Linux system and PHP web interface, undocumented features and internal pages, intercom and tally interfaces, default accounts and network services with hardening steps, HiSilicon media-pipeline diagnostics, board pinouts including the UART, firmware recovery, and translated release notes for firmware updates from 2020 to 2026.","description_zh":"一份自 2021 年起维护的单 README 笔记，作者是与厂商无关的设备用户，记录 LinkPi ENC 系列视频编码器和 TBS 2603SE 的内部结构；这些设备共用同一条固件线，作者最初的设备采用搭载 HiSilicon Hi3520DV400 的 F3520D 主板。内容涵盖 Linux 系统与 PHP 网页界面、未公开功能和内部页面、对讲与 tally 接口、默认账户与网络服务及加固步骤、HiSilicon 媒体管线诊断、包括 UART 在内的主板引脚定义、固件恢复，以及 2020 至 2026 年固件更新的翻译版发布说明。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"binassist","name":"BinAssist","name_zh":"BinAssist Binary Ninja 大模型辅助分析插件","url":"https://github.com/symgraph/BinAssist","evidence_url":"https://github.com/symgraph/BinAssist/blob/0f0b01a38cafde662b4ee8a2a35557c3b18df7ad/README.md","description_en":"Binary Ninja plugin by Jason Tang, who also wrote GhidrAssist and IDAssist, that adds a BinAssist sidebar for LLM-assisted analysis of the open binary. Its tabs explain functions at the LLIL, MLIL and HLIL levels and individual instructions, keep chats with context macros, MCP tool calling and an optional ReAct agent mode, propose function and variable renames, retypes and structures with confidence scores for review before they are applied, and build a semantic graph of functions and calls with community detection and source-to-sink taint paths, alongside retrieval over reference documents the analyst adds. A SymGraph tab imports and publishes names, graph data and documents through the hosted symgraph.ai service.","description_zh":"由 GhidrAssist 与 IDAssist 作者 Jason Tang 开发的 Binary Ninja 插件，在侧边栏加入 BinAssist 面板，借助大语言模型分析当前打开的二进制。各标签页可在 LLIL、MLIL 和 HLIL 层级解释函数，也能解释单条指令；保存支持上下文宏、MCP 工具调用和可选 ReAct 智能体模式的对话；为函数和变量提出带置信度评分的重命名、类型修改及结构体建议，并在审阅后应用；还能构建涵盖函数与调用关系的语义图谱，进行社区检测并查找从输入源到危险调用点的污点路径，同时可检索分析人员添加的参考文档。SymGraph 标签页则通过托管的 symgraph.ai 服务导入和发布名称、图谱数据及文档。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-27"},{"id":"reversejs-ast-deobfuscation-materials","name":"Supplementary AST-Based Deobfuscation Materials","name_zh":"ReverseJS AST 反混淆配套资料","url":"https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials","evidence_url":"https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/blob/37092955c2ad361364a2162149df9119045de3d0/README.md","description_en":"Companion code for the ReverseJS blog's 2022 series on deobfuscating JavaScript by manipulating abstract syntax trees with Babel. Each folder pairs a small obfuscated sample with a deobfuscator script and its output, covering string concealing (escape sequences, concatenation, string arrays and string encryption), constant folding including JSFuck-style code, substitution of constant variables, bracket-to-dot property access, dead-code removal, proxy functions and sequence expressions. The README presents them as short learning examples rather than a production deobfuscator.","description_zh":"ReverseJS 博客 2022 年系列文章的配套代码，该系列讲解如何借助 Babel 操作抽象语法树来反混淆 JavaScript。每个目录都包含一个小型混淆样例、对应的反混淆脚本及其输出，主题涵盖字符串隐藏（转义序列、字符串拼接、字符串数组和字符串加密）、常量折叠（含 JSFuck 风格代码）、常量变量替换、方括号属性访问改为点号访问、死代码删除、代理函数以及逗号序列表达式。README 将其定位为简短的学习示例，而非可用于生产的反混淆工具。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["website"],"verified_at":"2026-10-27"},{"id":"openpilot-cabana","name":"Cabana (standalone openpilot-cabana)","name_zh":"Cabana CAN 总线分析工具（独立版 openpilot-cabana）","url":"https://github.com/deanlee/openpilot-cabana","evidence_url":"https://github.com/deanlee/openpilot-cabana/blob/0a4b189798b33e4267fbf854c6f27fe4832998ab/README.md","description_en":"Qt desktop CAN and CAN FD analyzer for decoding signals and reverse engineering unknown messages, split out of openpilot's cabana by Dean Lee, a frequent contributor to it, and now maintained on its own. It shows live per-bit change heatmaps, colors bytes by trend such as counters, toggles or noisy data, searches for signals by value or for bits that change together across messages and buses, mutes known bits, plots signals and edits DBC files with undo, while replaying openpilot drives with synchronized camera video. Sources are openpilot routes, Vector ASC, candump and PEAK TRC logs, SocketCAN, comma.ai Panda devices and live streams from a comma device, with a bundled set of opendbc DBC files.","description_zh":"基于 Qt 的桌面 CAN 与 CAN FD 分析工具，用于解码信号和逆向分析未知报文；由 openpilot cabana 的活跃贡献者 Dean Lee 从 openpilot 中独立出来，现单独维护。它实时显示逐位变化热图，按计数器、切换位、噪声数据等趋势为字节着色，可按数值搜索信号或查找在不同报文和总线间同步变化的位，屏蔽已知位，绘制信号曲线，并以可撤销方式编辑 DBC 文件，同时能回放 openpilot 行车记录并同步显示摄像头视频。数据来源包括 openpilot 行车记录、Vector ASC、candump 和 PEAK TRC 日志、SocketCAN、comma.ai Panda 设备以及来自 comma 设备的实时流，并附带一组 opendbc DBC 文件。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"awesome-re-mcp","name":"Awesome RE-MCP","name_zh":"Awesome RE-MCP 逆向工具 MCP 服务器清单","url":"https://github.com/crowdere/Awesome-RE-MCP","evidence_url":"https://github.com/crowdere/Awesome-RE-MCP/blob/e400b882965ef61302718c7fe7c4f1e2861bd664/README.md","description_en":"A single-README list, written in July 2025, of 28 MCP servers for reverse-engineering tools, grouped into disassemblers and decompilers (IDA Pro, Ghidra, Binary Ninja and others), debuggers, static and dynamic analysis, network analysis, Android and security testing, with a one-line note per entry. It also names tools the author found without an MCP server, links four talks and guides, and points to starting material for writing new servers.","description_zh":"以单个 README 维护的清单，编写于 2025 年 7 月，收录 28 个逆向工程工具的 MCP 服务器，按反汇编器与反编译器（IDA Pro、Ghidra、Binary Ninja 等）、调试器、静态与动态分析、网络分析、Android 和安全测试分组，每项附一句说明。清单还列出作者认为尚无 MCP 服务器的工具，链接四个演讲与教程，并给出编写新服务器的入门资料。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-10-27"},{"id":"extremecoders-re-list","name":"RE list (extremecoders-re)","name_zh":"RE list 开源二进制逆向工具清单（extremecoders-re）","url":"https://github.com/extremecoders-re/re-list","evidence_url":"https://github.com/extremecoders-re/re-list/blob/539b60e6f4a17f42f07089b82c7cd909a1056f6f/README.md","description_en":"A single-README list of 71 open-source reverse-engineering tools with a focus on binary analysis, kept as one alphabetical list from Amoco to X86isa. Each entry gives the tool's name, a link and a one- to three-sentence description; the entries span binary analysis frameworks, lifters to LLVM and other intermediate representations, symbolic execution and emulation engines, dynamic instrumentation, whole-system and virtual-machine introspection platforms, decompilers, debugger front ends and deobfuscation tools.","description_zh":"以单个 README 维护的开源逆向工程工具清单，侧重二进制分析，共 71 项，按字母顺序从 Amoco 排到 X86isa，不分类别。每个条目给出工具名称、链接和一到三句说明，涵盖二进制分析框架、提升到 LLVM 及其他中间表示的工具、符号执行与模拟引擎、动态插桩、全系统分析与虚拟机自省平台、反编译器、调试器前端以及去混淆工具。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-27"},{"id":"dji-mimo-ble-reveng-case","name":"DJI MIMO BLE artifacts: reconstructing the DJI Osmo control protocol","name_zh":"DJI MIMO BLE 逆向素材：重建 DJI Osmo 控制协议","url":"https://github.com/xaionaro/reverse-engineering-dji","evidence_url":"https://github.com/xaionaro/reverse-engineering-dji/blob/5c9278ff0b53bbe0d03ea6c830aab13ac775871e/README.md","description_en":"Documents the Bluetooth Low Energy message format that DJI's proprietary MIMO app uses to control DJI Osmo devices, as artifacts produced while building the independent djictl CLI. The author derives the framing — a magic byte, length, protocol version, header CRC8, subsystem and message-id fields, a payload and a message CRC16 — from the author's own Android BLE logs, and ships a Wireshark dissector plus an annotated catalog of message types. Many message types are labelled as guesses or unknown; the author reports reaching working livestreaming on a DJI Osmo Pocket 3 and pausing further analysis.","description_zh":"记录 DJI 专有 MIMO 应用用于控制 DJI Osmo 设备的低功耗蓝牙报文格式，是作者在开发独立 CLI 工具 djictl 时产出的逆向工程素材。作者依据自己手机的蓝牙日志推断出报文结构——魔数、长度、协议版本、头部 CRC8、子系统与消息 ID 字段、载荷以及消息 CRC16——并提供一个 Wireshark 解析插件和一份带注释的消息类型目录。许多消息类型被标注为推测或未知；作者报告在 DJI Osmo Pocket 3 上实现了可用的直播推流后暂停了进一步分析。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"reversecore-mcp","name":"Reversecore MCP","name_zh":"Reversecore MCP 逆向与安全分析 MCP 服务器","url":"https://github.com/sjkim1127/Reversecore_MCP","evidence_url":"https://github.com/sjkim1127/Reversecore_MCP/blob/c1c576709e47d4947afec6e121111d44c036813c/README.md","description_en":"MCP server that puts radare2 with r2ghidra, LIEF, Capstone, YARA, CAPA, Detect It Easy, binwalk, angr, Volatility3, Scapy, Sleuth Kit and other engines behind 177 typed tools for AI clients such as Claude and Cursor. The tools cover disassembly and decompilation, binary parsing, string, IOC and capability extraction, ESIL emulation and symbolic execution, YARA scanning, memory, PCAP and disk forensics, source-code pattern scanning and session reports with MITRE ATT&CK mapping, alongside 22 guided analysis prompts and per-binary MCP resources. File access is confined to a configured sample workspace, and the server runs over stdio or HTTP/SSE, typically from the project's Docker image.","description_zh":"MCP 服务器，将 radare2 及 r2ghidra、LIEF、Capstone、YARA、CAPA、Detect It Easy、binwalk、angr、Volatility3、Scapy、Sleuth Kit 等引擎封装为 177 个带类型的工具，供 Claude、Cursor 等 AI 客户端调用。工具涵盖反汇编与反编译、二进制解析、字符串、IOC 与能力提取、ESIL 模拟与符号执行、YARA 扫描、内存、PCAP 与磁盘取证、源码模式扫描，以及带 MITRE ATT&CK 映射的会话报告，另有 22 种引导式分析提示词和按二进制划分的 MCP 资源。文件访问限定在配置的样本工作目录内，服务器通过 stdio 或 HTTP/SSE 运行，通常使用项目提供的 Docker 镜像。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-27"},{"id":"r2pipe","name":"r2pipe","name_zh":"r2pipe radare2 多语言脚本接口","url":"https://github.com/radareorg/radare2-r2pipe","evidence_url":"https://github.com/radareorg/radare2-r2pipe/blob/c3558109db3868f34b7bd6a02775611a9265d81a/README.md","description_en":"radare2's official scripting interface, with implementations for more than two dozen languages in one repository. Every binding sends radare2 command strings and returns their text output, the design behind r_core_cmd_str(), and the README recommends asking for JSON output and decoding it into native objects instead of using the C API. Bindings connect through the R2PIPE_IN/R2PIPE_OUT pipes of a script run from inside r2, a spawned r2 -q0 process, TCP, HTTP or radare2's RAP protocol, many offer asynchronous calls, and r2pipe scripts can also implement radare2 plugins such as disassemblers, IO backends or ESIL syscall handlers.","description_zh":"radare2 官方的脚本接口，同一仓库内收录了二十多种语言的实现。所有绑定都向 radare2 发送命令字符串并返回其文本输出，这正是 r_core_cmd_str() 背后的设计；README 建议请求 JSON 输出并将其解码为本地语言对象，而不是直接调用 C API。绑定可经由从 r2 内部运行脚本时的 R2PIPE_IN/R2PIPE_OUT 管道、新启动的 r2 -q0 进程、TCP、HTTP 或 radare2 自有的 RAP 协议连接，其中许多支持异步调用；r2pipe 脚本还可用于实现反汇编器、IO 后端或 ESIL 系统调用处理器等 radare2 插件。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"aptio-v-uefi-editor","name":"Aptio V UEFI Editor","name_zh":"Aptio V UEFI 设置编辑器","url":"https://github.com/BoringBoredom/UEFI-Editor","evidence_url":"https://github.com/BoringBoredom/UEFI-Editor/blob/44e8c9ba4a05dbd6fc4b1c247ed17948b6e58f8d/README.md","description_en":"Browser-based editor for the setup menus of AMI Aptio V UEFI firmware, offered as an alternative to AMIBCP. From four sections the user takes from their own BIOS image, it rebuilds the setup forms and their references and shows each setting's VarStore, offset, size, options, failsafe and optimal defaults, access level and Suppress If conditions. Changes to top-level menu targets, suppressions, access levels and defaults are written back into the section files with a change log, and a session can be saved as hash-checked JSON; a separate IFR-Formatter.js script condenses IFRExtractor-RS output into a per-setting VarStore and offset listing.","description_zh":"在浏览器中运行的 AMI Aptio V UEFI 固件设置菜单编辑器，作为 AMIBCP 的替代工具。它根据使用者从自己的 BIOS 镜像中取得的四个区段重建设置表单及其引用关系，并显示每个设置项的 VarStore、偏移、大小、选项、故障安全和最优默认值、访问级别以及 Suppress If 条件。对顶层菜单目标、隐藏条件、访问级别和默认值的修改会写回区段文件并附带变更日志，会话可另存为带哈希校验的 JSON；另附的 IFR-Formatter.js 脚本可将 IFRExtractor-RS 的输出整理为按设置项列出 VarStore 与偏移的清单。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"diztinguish","name":"DiztinGUIsh","name_zh":"DiztinGUIsh Super NES ROM 反汇编工具","url":"https://github.com/DizTools/DiztinGUIsh","evidence_url":"https://github.com/DizTools/DiztinGUIsh/blob/7484b87c3bd36f4e1a1e9e3c6075dd103855cbfd/README.md","description_en":"Windows disassembler for Super NES ROMs in which the user marks bytes as code or data, steps through 65816 code while the tool tracks the M and X flags and the data bank and direct page registers, adds labels and comments, and exports assembly for the asar assembler that the README says compiles back into the original binary. Execution context can come from BizHawk or BSNES trace logs, BSNES usage maps and BizHawk code/data logs, or live capture over a socket from a custom bsnes-plus build. Project files keep the annotations in merge-friendly XML with a link and checksum for the ROM rather than the ROM itself, so several people can work on one disassembly.","description_zh":"面向 Super NES ROM 的 Windows 反汇编工具：使用者把字节标记为代码或数据，逐步跟踪 65816 代码，工具同时记录 M、X 标志位以及数据库（data bank）和直接页寄存器；使用者添加标签和注释后，可导出供 asar 汇编器使用的汇编代码，README 称其能重新编译回原始二进制。执行上下文可来自 BizHawk 或 BSNES 的跟踪日志、BSNES 使用情况图和 BizHawk 代码/数据日志，也可通过套接字从定制的 bsnes-plus 版本实时采集。项目文件以便于合并的 XML 保存注释，只记录 ROM 的链接和校验和而不包含 ROM 本身，便于多人协作完成同一份反汇编。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-27"},{"id":"awesome-te","name":"awesome-te","name_zh":"awesome-te Teenage Engineering 设备破解资源目录","url":"https://github.com/bnjreece/awesome-te","evidence_url":"https://github.com/bnjreece/awesome-te/blob/02c9fb3c95b7fa4bae954be4d7ae795396d10e93/README.md","description_en":"A public-domain directory, started in June 2026, of hacking projects for Teenage Engineering devices: custom firmware, reverse-engineering notes and protocol documentation, tools, hardware mods, teardown and recovery guides and community hubs for the OP-1, OP-Z, OP-XY, TP-7, SP-1 Stem Player, EP series, Pocket Operators and other gear. One-line entries are grouped by device and task, each with a maintainer-assigned active, dormant or archived marker, and the scope rule admits only released, TE-specific projects.","description_zh":"一份进入公有领域的目录，始建于 2026 年 6 月，收录 Teenage Engineering 设备的破解与改造项目：涵盖 OP-1、OP-Z、OP-XY、TP-7、SP-1 Stem Player、EP 系列、Pocket Operator 等设备的自定义固件、逆向笔记与协议文档、工具、硬件改装、拆解与恢复指南以及社区站点。每个条目只有一行，按设备和用途分组，并由维护者标注活跃、休眠或归档状态；收录范围仅限已发布、专门针对 TE 设备的项目。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["firmware","protocol"],"verified_at":"2026-10-27"},{"id":"firmloader","name":"FirmLoader","name_zh":"FirmLoader 微控制器固件内存布局 IDA 插件","url":"https://github.com/Accenture/FirmLoader","evidence_url":"https://github.com/Accenture/FirmLoader/blob/5c9c1a149b2b638d1e2b65d39723b6a45379fdb1/README.md","description_en":"IDA plugin that applies a microcontroller's memory map to a raw firmware image: once the analyst picks an MCU model, it creates RAM and other memory segments, adds peripheral segments with named registers and, where a vector table is described, labels its entries and turns the handlers they point to into functions. The README compares it to IDA's built-in SVD loader, but it uses a simpler JSON description that can be written by hand from public datasheets. The reviewed commit bundles 813 descriptions for Microchip/Atmel, ST, NXP, TI, Silicon Labs and other MCUs.","description_zh":"为原始微控制器固件镜像套用芯片内存布局的 IDA 插件：分析者选定 MCU 型号后，它会创建 RAM 等内存段，添加带有寄存器命名的外设段，并在描述文件包含中断向量表时标注各表项，把它们指向的处理程序创建为函数。README 称其类似 IDA 内置的 SVD 加载器，但采用更简单的 JSON 描述格式，可依据公开的数据手册手工编写。所审阅提交附带 813 个描述文件，涵盖 Microchip/Atmel、ST、NXP、TI、Silicon Labs 等厂商的 MCU。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"catprinterble-mxw01-printer-case","name":"Cat Printer BLE: reconstructing the MXW01 thermal printer protocol","name_zh":"Cat Printer BLE：重建 MXW01 热敏打印机协议","url":"https://github.com/MaikelChan/CatPrinterBLE","evidence_url":"https://github.com/MaikelChan/CatPrinterBLE/blob/007f82151fe40250bd3d5328139e588ea99364ac/README.md","description_en":"Replaces the vendor phone app for the MXW01 “cat printer”, a small Bluetooth Low Energy thermal printer, with a Windows command-line client. The author reports starting from the iOS-only Moblin implementation and then reverse-engineering the vendor's phone app further, and the client sends CRC8-checked commands to one GATT service while streaming 384-pixel image lines in 1-bit or 4-bit grayscale. Several command IDs remain marked as unknown, and the author tested only this one printer model.","description_zh":"以一个 Windows 命令行客户端替代 MXW01“猫猫打印机”（一款小型低功耗蓝牙热敏打印机）的厂商手机应用。作者称以仅支持 iOS 的 Moblin 实现为起点，再进一步逆向厂商的手机应用；该客户端向一个 GATT 服务发送带 CRC8 校验的命令，并以 1 位或 4 位灰度传输每行 384 像素的图像数据。若干命令 ID 仍标为未知，作者也只测试了这一款打印机。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"0x1avram-js-deobfuscator","name":"JS-Deobfuscator (0x1Avram)","name_zh":"JS-Deobfuscator（0x1Avram）Obfuscator.io 反混淆工具","url":"https://github.com/0x1Avram/js-deobfuscator","evidence_url":"https://github.com/0x1Avram/js-deobfuscator/blob/3a4a20ab0d107d168bbef14105c35970c59e4eae/README.md","description_en":"Node.js deobfuscator for JavaScript produced by Timofey Kachalov's javascript-obfuscator, also offered as obfuscator.io. It parses the sample with esprima and runs eleven stages named after the obfuscator's own, which remove injected self-defending and debug-protection code, unwind control-flow flattening and dead-code injection, restore converted literals and object keys, replace string-array calls with the decoded strings, simplify the result and recursively process code passed to eval. String-array code is detected automatically or supplied as separate files, and an Examples folder pairs original, obfuscated and deobfuscated samples.","description_zh":"面向 Timofey Kachalov 的 javascript-obfuscator（亦以 obfuscator.io 提供）所生成 JavaScript 的 Node.js 反混淆工具。它用 esprima 解析样本，依次运行十一个与该混淆器同名的阶段：移除注入的自我防护和调试保护代码，还原控制流平坦化和死代码注入，恢复被转换的字面量和对象键，把字符串数组调用替换为解码后的字符串，化简结果，并对传给 eval 的代码递归处理。字符串数组相关代码可自动识别，也可拆成单独文件输入；Examples 目录收录了原始、混淆后和反混淆后的成对样本。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-27"},{"id":"a0rfid-uhf-reader-protocol-case","name":"a0rfid: an open driver for A0-protocol UHF RFID readers","name_zh":"a0rfid：A0 协议 UHF RFID 读写头的开源驱动","url":"https://github.com/uaih3k9x/a0rfid","evidence_url":"https://github.com/uaih3k9x/a0rfid/blob/944ec1581a5c989cc7fbd50fcdba27159ecf7aa1/README.md","description_en":"Reconstructs the A0 serial protocol of R2000-family 915 MHz UHF RFID desktop readers, which ship with only Windows software and an Android app, from the vendor app's native command encoder rather than its misleading Java SDK. A userspace CH340 driver, a Python CLI and GUI, and a small Android app then talk to the reader directly for inventory and tag-memory reads. docs/PROTOCOL.md records the frame layout, checksum, command table, response formats and the different field orders of READ and WRITE.","description_zh":"从厂商安卓应用的原生指令编码器（而非其具有误导性的 Java SDK）重建 R2000 系列 915 MHz UHF RFID 桌面读写头的 A0 串口协议；这类读写头原本只随附 Windows 软件和安卓应用。项目据此提供用户态 CH340 驱动、Python 命令行与图形界面，以及小型安卓应用，直接与读写头通信，进行标签盘存并读取标签存储区。docs/PROTOCOL.md 记录了帧格式、校验和、指令表、响应格式，以及 READ 与 WRITE 不同的字段顺序。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"ultrasina-android-reverse","name":"Android Reverse","name_zh":"Android Reverse 设备端逆向套件","url":"https://github.com/UltraSina/androidReverse","evidence_url":"https://github.com/UltraSina/androidReverse/blob/ad9dd7ab4770b089b785039a36be57f50c35f3f0/README.md","description_en":"Android app, published only as release APKs, that runs an APK reverse-engineering workflow entirely on the phone, from package extraction and Java decompilation to native analysis, editing and rebuilding. It extracts APK, XAPK and split APKS packages from storage or installed apps, decompiles each class with Jadx (with fallback and IR modes), CFR, Procyon, JD-Core, Krakatau or Vineflower, analyzes native libraries through an embedded radare2 with pseudo-C, assembly, hex, control-flow-graph and call-graph views, and since v20 edits resources, binary XML, the manifest and smali before rebuilding and signing the APK. A built-in MCP server lets MCP clients edit those project files while rebuilding stays a manual step; the README also lists Flutter Dart AOT analysis through Unflutter and Unity il2cpp metadata parsing.","description_zh":"一款仅以发布版 APK 形式提供的 Android 应用，把 APK 逆向工作流全部放在手机上完成，涵盖安装包提取、Java 反编译、原生代码分析、编辑和重新打包。它可从存储或已安装应用中提取 APK、XAPK 和拆分的 APKS 安装包，逐个类在 Jadx（含回退与 IR 模式）、CFR、Procyon、JD-Core、Krakatau 和 Vineflower 之间选择引擎反编译，通过内嵌的 radare2 分析原生库并提供伪 C、汇编、十六进制、控制流图和调用图视图；自 v20 起还能编辑资源、二进制 XML、清单和 smali，再重新打包并签名 APK。内置的 MCP 服务器允许 MCP 客户端编辑这些项目文件，重新构建仍需用户手动触发；README 还列出借助 Unflutter 分析 Flutter 的 Dart AOT 代码以及解析 Unity il2cpp 元数据。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"ecapture","name":"eCapture","name_zh":"eCapture eBPF TLS 明文捕获工具","url":"https://github.com/gojue/ecapture","evidence_url":"https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/README.md","description_en":"eBPF-based Linux and Android tool that attaches uprobes to TLS libraries such as OpenSSL, BoringSSL, GnuTLS and NSS, and to Go's TLS stack, recording the plaintext a process sends and receives without a proxy or an installed CA certificate, so analysts can inspect an application's encrypted traffic on a host they control. Output modes write plaintext text, NSS key logs, or pcapng files with embedded TLS secrets for Wireshark and tshark, and a text mode can rebuild complete HTTP/1.1 and HTTP/2 messages from the captured stream. Separate modules audit bash and zsh commands and MySQL and PostgreSQL queries.","description_zh":"基于 eBPF 的 Linux 与 Android 工具，在 OpenSSL、BoringSSL、GnuTLS、NSS 等 TLS 库以及 Go 的 TLS 实现上挂载 uprobe，记录进程收发的明文，无需代理或安装 CA 证书，便于分析者在自己掌控的主机上检查应用的加密流量。输出模式包括明文文本、NSS 密钥日志，以及内嵌 TLS 密钥、可交给 Wireshark 和 tshark 解读的 pcapng 文件；文本模式还能从捕获的数据流中重建完整的 HTTP/1.1 和 HTTP/2 报文。另有独立模块审计 bash、zsh 命令以及 MySQL、PostgreSQL 查询。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-27"},{"id":"autoprober","name":"AutoProber","name_zh":"AutoProber 飞针探测自动化套件","url":"https://github.com/GainSec/AutoProber","evidence_url":"https://github.com/GainSec/AutoProber/blob/ff0e01fe556c7e183d46462dbc1ebce7b6a10e74/README.md","description_en":"Flying-probe control stack meant to let a coding agent or an operator take a circuit board on a GRBL 3018-style CNC from locating it on the plate, through XYZ-tagged USB-microscope frames and an annotated map of pads, pins and chips, to probing targets the operator has approved. Python wrappers, a Flask dashboard and AGENTS.md safety rules run every move under an oscilloscope-monitored optical endstop that triggers feed hold and a STOP state with no automatic recovery. The published code covers device control, camera-to-motion calibration and map and probe-candidate review; the README presents locating, stitching and annotating the board as agent tasks.","description_zh":"飞针探测控制套件，旨在让编程智能体或操作员在 GRBL 3018 型 CNC 上处理电路板：先在平台上定位电路板，再拍摄带 XYZ 坐标的 USB 显微镜画面并生成标注焊盘、引脚和芯片的地图，最后探测经操作员批准的目标点。Python 封装、Flask 仪表盘和 AGENTS.md 安全规则让每次移动都处于示波器监测的光电限位之下，一旦触发即暂停进给并进入 STOP 状态，不会自动恢复。公开的代码涵盖设备控制、相机与运动的标定，以及地图和探测候选点的审核；README 把定位、拼接和标注电路板描述为智能体的任务。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"mcp-reversing-dataset","name":"MCP Reversing Dataset (mrexodia)","name_zh":"MCP 逆向数据集（mrexodia）","url":"https://github.com/mrexodia/mcp-reversing-dataset","evidence_url":"https://github.com/mrexodia/mcp-reversing-dataset/blob/523ce22b9b0d3371f6dfc8f344e604064dc0ef97/README.md","description_en":"Three worked examples by mrexodia of a language model reverse-engineering crackme binaries in IDA Pro through his IDA Pro MCP server. Each folder holds the input binary, a README giving its origin, the prompt and the model, the agent's own report and the exported session transcript, so readers can follow every tool call, rename, retype and comment the agent made on the database. The tasks cover a small Linux password check, an obfuscated Linux flag checker and a Windows crackme that, according to the agent's report, routes its checks through vectored exception handling.","description_zh":"mrexodia 发布的三个实例，展示语言模型借助他编写的 IDA Pro MCP 服务器在 IDA Pro 中逆向分析 crackme 二进制。每个文件夹都包含输入二进制、说明其来源、所用提示词和模型的 README、智能体自己撰写的报告以及导出的会话记录，读者可以逐一查看智能体对数据库的每次工具调用、重命名、类型修改和注释。三个任务分别是一个简单的 Linux 密码校验程序、一个经过混淆的 Linux flag 校验程序，以及一个 Windows crackme；据智能体的报告，它借助向量化异常处理来执行校验。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-27"},{"id":"jsc-decompile-mozjs-34","name":"jsc-decompile-mozjs-34","name_zh":"jsc-decompile-mozjs-34 SpiderMonkey 字节码反编译器","url":"https://github.com/irelance/jsc-decompile-mozjs-34","evidence_url":"https://github.com/irelance/jsc-decompile-mozjs-34/blob/44ffa1b0bb5ffc42231fcfcb60c5e6a3bc366062/readme.md","description_en":"PHP decoder and decompiler for SpiderMonkey 34 JavaScript bytecode, which the README says may handle .jsc files compiled by cocos2d-x. It parses the XDR-serialized scripts with their atoms, constants, objects, regular expressions and try and scope notes, decodes instructions from a SpiderMonkey 34 opcode table and rebuilds approximate JavaScript for each function context, while a second script prints the decoded operations instead. The author describes it as unfinished and as an example of how a JavaScript virtual machine works.","description_zh":"用 PHP 编写的 SpiderMonkey 34 JavaScript 字节码解码与反编译工具，README 称它可能可以处理 cocos2d-x 编译生成的 .jsc 文件。它解析以 XDR 序列化的脚本及其中的原子（atom）、常量、对象、正则表达式和 try/作用域注记，依据 SpiderMonkey 34 的操作码表解码指令，并为每个函数上下文重建近似的 JavaScript 代码；另一个脚本则改为输出解码后的操作序列。作者称该项目尚未完成，可作为理解 JavaScript 虚拟机工作方式的示例。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app","game"],"verified_at":"2026-10-27"},{"id":"andromeda","name":"Andromeda","name_zh":"Andromeda Android 应用交互式逆向工具","url":"https://github.com/secrary/Andromeda","evidence_url":"https://github.com/secrary/Andromeda/blob/50fdaaf59328fb3430d76d92c6319d2232766f7a/README.md","description_en":"Interactive command-line tool by Lasha Khasaia for first-pass reverse engineering of Android APKs, written in C/C++ for speed. It unpacks an APK, parses AndroidManifest.xml, the signing certificate and the DEX files at the archive root, then opens a shell with tab completion for listing permissions, activities, services, receivers and likely entry points, listing and searching classes, methods and strings, disassembling a method's Dalvik bytecode and listing, hashing or extracting native libraries. Further commands report whether the app is debuggable, a creation date taken from its certificate, URL and email strings, and a guess at whether it was written in Java, Kotlin or Xamarin .NET.","description_zh":"Lasha Khasaia 开发的交互式命令行工具，用于对 Android APK 做初步逆向分析，以 C/C++ 编写以求速度。它解包 APK，解析 AndroidManifest.xml、签名证书和压缩包根目录下的 DEX 文件，随后打开一个支持 Tab 补全的交互环境，可列出权限、Activity、Service、Receiver 和可能的入口点，列出并搜索类、方法和字符串，反汇编某个方法的 Dalvik 字节码，以及列出、计算哈希或提取原生库。其他命令可报告应用是否可调试、依据证书得出的创建日期、URL 和电子邮件字符串，并推测应用使用 Java、Kotlin 还是 Xamarin .NET 编写。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"dex-editor-android","name":"Dex-Editor-Android","name_zh":"Dex-Editor-Android 设备端 DEX 编辑器","url":"https://github.com/developer-krushna/Dex-Editor-Android","evidence_url":"https://github.com/developer-krushna/Dex-Editor-Android/blob/55fd9f03ae43b321e56b5b99677b7f6705e39158/README.md","description_en":"Work-in-progress Android app for editing DEX files on the device, built on a modified in-tree copy of Google's smali, baksmali and dexlib2. It loads one or more DEX files into a class tree and opens classes as smali in a Sora Editor view with method, field and string lists, label jumps, search and replace, method flow diagrams and Jadx decompilation of a class or method to Java, then deletes classes or recompiles the edited DEX files. The README credits MT Manager for the app's logic and interface ideas.","description_zh":"一款仍在开发中的 Android 应用，用于在设备上编辑 DEX 文件，构建在仓库内经修改的 Google smali、baksmali 和 dexlib2 副本之上。它把一个或多个 DEX 文件载入类树，在基于 Sora Editor 的编辑器中以 smali 打开类，提供方法、字段和字符串列表、标签跳转、搜索替换、方法流程图，以及借助 Jadx 把单个类或方法反编译为 Java，之后可删除类或重新编译修改后的 DEX 文件。README 称应用的逻辑与界面构思来自 MT Manager。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"grease","name":"GREASE","name_zh":"GREASE 欠约束符号执行二进制分析工具","url":"https://github.com/GaloisInc/grease","evidence_url":"https://github.com/GaloisInc/grease/blob/b94e1e010c289cf579fe868307857a417d6e3a2c/doc/overview.md","description_en":"Galois's command-line tool, Ghidra plug-in and Haskell library for checking properties of binaries with under-constrained symbolic execution. It lifts AArch32, PowerPC or x86_64 ELF executables and shared objects, or LLVM bitcode, into a control-flow graph, simulates each function from fully symbolic registers and grows the inferred memory layout after out-of-bounds accesses, then reports likely undefined behavior such as division by zero or invalid memory access together with concretized arguments. Built-in overrides, or user overrides written in Crucible's S-expression language, model external library functions, and the plug-in presents results in Ghidra.","description_zh":"Galois 开发的命令行工具、Ghidra 插件和 Haskell 库，借助欠约束符号执行检查二进制程序的性质。它把 AArch32、PowerPC 或 x86_64 的 ELF 可执行文件和共享对象（或 LLVM bitcode）转换为控制流图，从所有寄存器均为符号值的状态模拟每个函数，并在发生越界访问后逐步扩充推断出的内存布局，最终报告除零、非法内存访问等可能的未定义行为，并给出具体化的参数。内置覆盖（override）或用户以 Crucible S 表达式语言编写的覆盖可模拟外部库函数，插件则在 Ghidra 中展示结果。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"ifda-iot-firmware-deep-analysis","name":"IFDA (IoT Firmware Deep Analysis)","name_zh":"IFDA IoT 固件深度分析工具","url":"https://github.com/cn0xroot/IFDA","evidence_url":"https://github.com/cn0xroot/IFDA/blob/90c11c2179c8a1c907529a9e866c06b636375077/README.md","description_en":"Static analysis pipeline for extracted IoT firmware: pointed at one ELF or an unpacked root filesystem, it disassembles binaries with Capstone for x86, ARM/Thumb-2, AArch64 and MIPS, recovers functions, call graphs and exploit mitigations, and reports candidate issues from dangerous-function calls, call-graph taint paths, CVE correlation through cve-bin-tool, embedded secrets, script injection patterns and filesystem hardening checks. Reports come out as JSON, Markdown and a CycloneDX SBOM. Optional add-ons are Ghidra headless pseudocode, moria-based extraction of raw images and a Go service with a job queue, REST API, bilingual web UI and an LLM agent that triages a finished scan's findings.","description_zh":"面向已解包 IoT 固件的静态分析流水线：对单个 ELF 或解包后的根文件系统，它用 Capstone 反汇编 x86、ARM/Thumb-2、AArch64 和 MIPS 二进制，恢复函数、调用图和漏洞缓解措施，并从危险函数调用、调用图污点路径、借助 cve-bin-tool 的 CVE 关联、内嵌密钥、脚本注入模式和文件系统加固检查中报告候选问题。报告以 JSON、Markdown 和 CycloneDX SBOM 输出。可选组件包括 Ghidra 无界面伪代码、基于 moria 的原始镜像解包，以及一个 Go 服务，提供任务队列、REST API、中英双语网页界面，并可由大模型智能体对已完成的扫描结果进行分诊。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-27"},{"id":"smali-baksmali","name":"smali/baksmali","name_zh":"smali/baksmali Dalvik dex 汇编与反汇编器","url":"https://github.com/JesusFreke/smali","evidence_url":"https://github.com/JesusFreke/smali/blob/2771eae0a11f07bd892732232e6ee4e32437230d/README.md","description_en":"Assembler and disassembler for the dex format used by Android's Dalvik VM: baksmali turns dex, APK, odex and oat files into smali text, and smali assembles that text back into a dex file. The README says the syntax, loosely based on Jasmin's and dedexer's, supports the full dex format, including annotations and debug and line information. baksmali can also deodex odex and oat files and list a dex file's classes, methods, fields, strings and references, while the dexlib2 library reads and writes dex files from Java.","description_zh":"面向 Android Dalvik 虚拟机 dex 格式的汇编器与反汇编器：baksmali 将 dex、APK、odex 和 oat 文件反汇编为 smali 文本，smali 再把这些文本汇编回 dex 文件。README 称其语法大致参照 Jasmin 和 dedexer，支持 dex 格式的全部功能，包括注解、调试信息和行号信息。baksmali 还能对 odex 和 oat 文件做去优化（deodex），并列出 dex 文件中的类、方法、字段、字符串和引用；dexlib2 库则供 Java 程序读写 dex 文件。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"http-toolkit","name":"HTTP Toolkit","name_zh":"HTTP Toolkit HTTP(S) 调试代理","url":"https://github.com/httptoolkit/httptoolkit","evidence_url":"https://github.com/httptoolkit/httptoolkit/blob/bb579a8ceadfe86b98160843c0447a5b9eec554f/README.md","description_en":"Open-source HTTP(S) debugging proxy for Windows, Linux and macOS that sets up interception for browsers, terminals, backend runtimes, Electron apps and Android devices, then shows the full headers and body of every request and response with body decoding, inline header documentation and filtering. Its transparent proxy handles plain HTTP, HTTPS, HTTP/2 and WebSockets on one port; breakpoints rewrite live requests or responses, and a built-in client sends custom requests. This repository is the project's umbrella README and issue tracker, while the UI, server, Mockttp proxy library, Android app and desktop shell live in sibling repositories.","description_zh":"面向 Windows、Linux 和 macOS 的开源 HTTP(S) 调试代理，可为浏览器、终端、后端运行时、Electron 应用和 Android 设备配置拦截，并完整展示每个请求与响应的头部和正文，提供正文解码、标准头部内联说明和过滤功能。其透明代理在同一端口处理明文 HTTP、HTTPS、HTTP/2 和 WebSocket；断点可改写实时请求或响应，内置客户端可发送自定义请求。本仓库是项目的总说明与问题追踪仓库，界面、服务端、Mockttp 代理库、Android 应用和桌面外壳位于同一组织的其他仓库。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["app","protocol","website"],"verified_at":"2026-10-27"},{"id":"awesome-uefi-security","name":"Awesome UEFI Security","name_zh":"Awesome UEFI Security UEFI 安全资料清单","url":"https://github.com/river-li/awesome-uefi-security","evidence_url":"https://github.com/river-li/awesome-uefi-security/blob/970e6c0de787a4cffa41e6d8b14f024526ccdd33/README.md","description_en":"A single-README awesome list of UEFI and BIOS security material, which its maintainer describes as a personal and not comprehensive collection. It links UEFI, PI and ACPI specifications, EDK II development resources, firmware analysis tools such as UEFITool, efiXplorer, CHIPSEC and UEFI plugins for Ghidra and Binary Ninja, SMM-themed CTF challenges, analyses of bootkits found in the wild, vulnerability write-ups, conference talks, blog posts, papers and training courses.","description_zh":"以单个 README 维护的 UEFI 与 BIOS 安全资料 awesome 清单，维护者称其为个人收集、并不全面。清单链接 UEFI、PI 与 ACPI 规范，EDK II 开发资源，UEFITool、efiXplorer、CHIPSEC 及 Ghidra 和 Binary Ninja 的 UEFI 插件等固件分析工具，以 SMM 为主题的 CTF 题目，对在野 bootkit 的分析报告，漏洞分析文章，会议演讲、博客、论文和培训课程。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"plasma-disassembler","name":"PLASMA","name_zh":"PLASMA 交互式反汇编器","url":"https://github.com/plasma-disassembler/plasma","evidence_url":"https://github.com/plasma-disassembler/plasma/blob/ec7df9b2b9b356dd5d8caf01b7e68c0ab5a1ef42/README.md","description_en":"Interactive terminal disassembler, formerly named Reverse, for x86 and x86-64 with partial ARM and MIPS/MIPS64 support, reading ELF, PE and raw binaries. Its visual mode shows functions as indented, colored pseudo-code and lets the analyst reshape the flow by inverting conditional jumps, while a Python API runs scripts for strings, cross-reference call graphs, crypto-constant detection and Keystone assembly. Development stopped in 2019, and the repository has no releases.","description_zh":"交互式终端反汇编器，旧名 Reverse，支持 x86 与 x86-64，并部分支持 ARM 和 MIPS/MIPS64，可读取 ELF、PE 和原始二进制。其可视化模式以缩进、着色的伪代码显示函数，分析者可通过反转条件跳转来调整控制流；Python API 可运行脚本，用于提取字符串、生成交叉引用调用图、检测加密常量以及调用 Keystone 汇编。项目自 2019 年起停止开发，仓库没有发布版本。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"mobdevim","name":"mobdevim","name_zh":"mobdevim iOS 设备命令行工具","url":"https://github.com/DerekSelander/mobdevim","evidence_url":"https://github.com/DerekSelander/mobdevim/blob/68cddb31bf80f9adf030d51bc799740f042d5958/README.md","description_en":"Derek Selander's macOS command-line utility for inspecting and controlling iOS devices connected over USB or Wi-Fi through Apple's private MobileDevice framework. It lists devices and installed apps with their Info.plist keys and entitlements, streams the device console, fetches crash logs, shows provisioning profiles and developer certificates, copies an app's data container off the device and back where the sandbox allows, and installs, uninstalls and launches apps with arguments and environment variables. With a Developer Disk Image mounted it also lists and kills processes and simulates location, and output can be printed as plist for scripts.","description_zh":"Derek Selander 编写的 macOS 命令行工具，通过 Apple 的私有 MobileDevice 框架检查和控制经 USB 或 Wi-Fi 连接的 iOS 设备。它可列出设备和已安装应用及其 Info.plist 键值与权限（entitlements），实时输出设备控制台日志，获取崩溃日志，查看描述文件和开发者证书，在沙盒允许时把应用的数据容器拷出设备并传回，还能安装、卸载应用，并带参数和环境变量启动应用。挂载开发者磁盘映像（DDI）后，还能列出和结束进程、模拟定位；输出可按 plist 格式打印，便于脚本处理。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"dalvikus","name":"dalvikus","name_zh":"dalvikus Android 逆向与 smali 编辑工具","url":"https://github.com/loerting/dalvikus","evidence_url":"https://github.com/loerting/dalvikus/blob/931cbf3659b4caeb533239337179630185969d04/README.MD","description_en":"Desktop Android reverse-engineering and modification workbench built with Kotlin Compose Multiplatform. It opens APK and DEX files, edits the DEX classes inside an APK as smali without manual unpacking, with syntax highlighting and code completion, and shows decompiled Java from JADX, CFR or Vineflower. It also browses resources and XML through apktool, searches the class tree, string constants and method and field references, re-signs modified APKs with apksig and zipalign, and installs and starts them on a connected device over ADB.","description_zh":"基于 Kotlin Compose Multiplatform 的桌面端 Android 逆向与修改工作台。它可打开 APK 和 DEX 文件，无需手动解包即可将 APK 内的 DEX 类作为 smali 编辑，提供语法高亮和代码补全，并可显示由 JADX、CFR 或 Vineflower 反编译出的 Java 代码。它还能通过 apktool 浏览资源和 XML 文件，在类树、字符串常量以及方法和字段引用中搜索，用 apksig 和 zipalign 为修改后的 APK 重新签名，并通过 ADB 将其安装到已连接的设备上运行。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"firmware-analysis-papers-list","name":"Firmware-Analysis-Papers","name_zh":"Firmware-Analysis-Papers 固件分析论文清单","url":"https://github.com/onehouwong/Firmware-Analysis-Papers","evidence_url":"https://github.com/onehouwong/Firmware-Analysis-Papers/blob/3cfec539b6570307412909a3959b6fbc24c75af6/README.md","description_en":"A single-README reading list of 28 academic security papers on firmware and embedded-system analysis, grouped by year from 2013 to 2021. It covers rehosting and emulation, firmware fuzzing, symbolic execution, Bluetooth and baseband analysis and bug detection in Linux-based and bare-metal firmware. Each entry is a title linked to a PDF or publisher page, with its venue such as USENIX Security, NDSS, IEEE S&P or CCS.","description_zh":"以单个 README 维护的学术安全论文阅读清单，收录 28 篇固件与嵌入式系统分析论文，按年份分组，时间跨度为 2013 至 2021 年。内容涵盖固件重托管与仿真、固件模糊测试、符号执行、蓝牙与基带分析，以及基于 Linux 和裸机固件中的缺陷检测。每个条目是链接到 PDF 或出版方页面的论文标题，并注明 USENIX Security、NDSS、IEEE S&P、CCS 等发表场合。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"xpeviewer","name":"XPEViewer","name_zh":"XPEViewer PE 文件查看与编辑工具","url":"https://github.com/horsicq/XPEViewer","evidence_url":"https://github.com/horsicq/XPEViewer/blob/828a0fbe8ba5586cec173609cb33c6f1a4f754df/README.md","description_en":"Qt-based PE file viewer and editor for Windows, Linux and macOS by horsicq, the author of the catalog's Detect It Easy. Its PE view parses the DOS, NT and optional headers, sections, normal, delay-load and bound imports, exports, resources including manifests, version data and string tables, relocations, TLS callbacks, exception, debug and load-configuration data, certificates, the Rich header and .NET metadata tables. Hex, disassembly, strings, entropy, hash, memory-map and extractor views sit beside Detect It Easy, Nauz File Detector and YARA scans and an optional VirusTotal lookup.","description_zh":"horsicq 开发的基于 Qt 的 PE 文件查看与编辑工具，支持 Windows、Linux 和 macOS；作者也是本目录所收录 Detect It Easy 的作者。其 PE 视图可解析 DOS 头、NT 头和可选头、节区、普通导入、延迟加载导入和绑定导入、导出、资源（包括清单、版本信息和字符串表）、重定位、TLS 回调、异常、调试和加载配置数据、证书、Rich 头以及 .NET 元数据表。另有十六进制、反汇编、字符串、熵、哈希、内存映射和提取器视图，并集成 Detect It Easy、Nauz File Detector 和 YARA 扫描，以及可选的 VirusTotal 查询。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"fermion","name":"Fermion","name_zh":"Fermion Frida 脚本图形化开发环境","url":"https://github.com/FuzzySecurity/Fermion","evidence_url":"https://github.com/FuzzySecurity/Fermion/blob/79b26434f85a9f4d5e812553ec8e2c08d2ab82c5/README.md","description_en":"Ruben Boonen's Electron desktop application that wraps frida-node and the Monaco editor into one window for writing, injecting and refining Frida scripts. The editor brings linting, IntelliSense and Frida API type definitions, a device menu reaches local, USB and remote Frida servers to attach to or spawn processes, scripts reload in the target with a keyboard shortcut and their output appears beside the code. A prototype CALL tracer follows every call a thread makes from a chosen pointer or module symbol until it returns and renders the result as a Graphviz SVG graph, and Frida's JavaScript API documentation is built in.","description_zh":"Ruben Boonen 开发的 Electron 桌面应用，把 frida-node 和 Monaco 编辑器整合到同一个窗口中，用于编写、注入和反复调整 Frida 脚本。编辑器提供代码检查、IntelliSense 和 Frida API 类型定义；设备菜单可连接本地、USB 和远程 Frida 服务端，附加到进程或启动新进程；脚本可用快捷键在目标中重新加载，输出显示在代码旁边。原型阶段的 CALL 追踪器从选定的指针或模块符号开始，跟踪线程发出的每一次调用直至返回，并将结果渲染为 Graphviz SVG 图；应用还内置了 Frida JavaScript API 文档。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-27"},{"id":"usbpcap","name":"USBPcap","name_zh":"USBPcap Windows USB 抓包工具","url":"https://github.com/desowin/usbpcap","evidence_url":"https://github.com/desowin/usbpcap/blob/477b6edcbd7e99a47f77afc0c4168a9ebee603bb/README","description_en":"Tomasz Moń's open-source USB packet capture for Windows. A filter driver installed in the Windows USB device stack records the USB Request Blocks (URBs) exchanged with devices on each root hub, and USBPcapCMD writes them to pcap files in the LINKTYPE_USBPCAP format, which Wireshark dissects. Since 1.2.0.0 the project has recommended running USBPcapCMD as a Wireshark extcap: each root hub then appears as a capture interface, with options to capture selected, all or newly connected devices and to add the descriptors of devices that are already attached.","description_zh":"Tomasz Moń 开发的开源 Windows USB 抓包工具。安装在 Windows USB 设备栈中的过滤驱动会记录各根集线器上设备收发的 USB 请求块（URB），再由 USBPcapCMD 写成 LINKTYPE_USBPCAP 格式的 pcap 文件，供 Wireshark 解析。从 1.2.0.0 版起，项目推荐把 USBPcapCMD 作为 Wireshark extcap 使用：每个根集线器会显示为一个抓包接口，可选择抓取指定设备、全部设备或新接入的设备，还能把已连接设备的描述符补进抓包数据。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"xiaomi-kettle-ble-protocol-case","name":"Xiaomi Kettle BLE protocol: reconstructing a smart kettle's control interface","name_zh":"Xiaomi Kettle BLE protocol：重建智能电水壶的控制接口","url":"https://github.com/anna-oake/xiaomi-kettle","evidence_url":"https://github.com/anna-oake/xiaomi-kettle/blob/fbc0b513bed9fbe08edaa97d33e2e12e04d02544/README.md","description_en":"Documents the closed Bluetooth Low Energy GATT protocol of the Xiaomi Kettle, which the author reconstructed by decompiling the Mi Home Android app and disassembling its native encryption library. The write-up covers the connection and authentication handshake, the layout of status notifications and the writable settings characteristics, with a small Go reimplementation of the cipher helpers. The author built a kettle-to-MQTT bridge for Home Assistant from it but did not publish that code, and gives no guarantee that the notes work for others.","description_zh":"记录 Xiaomi 电水壶封闭的低功耗蓝牙 GATT 协议；作者通过反编译 Mi Home Android 应用并反汇编其负责加密的原生库重建了该协议。文档涵盖连接与认证握手、状态通知的数据布局以及可写入的设置特征值，并附有用 Go 重新实现的少量加密辅助函数。作者据此开发了接入 Home Assistant 的水壶–MQTT 桥接程序，但未公开其代码，也不保证这些笔记对他人同样适用。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"cantools","name":"cantools","name_zh":"cantools CAN 总线数据库工具","url":"https://github.com/cantools/cantools","evidence_url":"https://github.com/cantools/cantools/blob/5d37340b321c60cbf9b61f2abfad352751f5c835/README.rst","description_en":"Python 3 library and command-line tool for CAN bus databases that parses DBC, KCD, SYM, ARXML 3/4 and CDD files and encodes and decodes CAN messages, including simple and extended signal multiplexing and diagnostic DIDs. Its CLI decodes candump output against a database, plots decoded signals from candump logs with matplotlib, dumps each message's bit layout, converts between database formats, generates C pack and unpack code, and monitors a live bus in a text interface through python-can.","description_zh":"面向 CAN 总线数据库的 Python 3 库和命令行工具，可解析 DBC、KCD、SYM、ARXML 3/4 和 CDD 文件，对 CAN 报文进行编码和解码，支持简单与扩展信号多路复用以及诊断 DID。其命令行可依据数据库解码 candump 输出、用 matplotlib 绘制 candump 日志中解码出的信号、转储每条报文的位布局、在数据库格式之间转换、生成 C 语言打包与解包代码，并通过 python-can 在文本界面中监视实时总线。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"inspectrum","name":"inspectrum","name_zh":"inspectrum 无线电信号分析工具","url":"https://github.com/miek/inspectrum","evidence_url":"https://github.com/miek/inspectrum/blob/82f5779ee3b82fc2b4d6d1360d9106392a71d4ab/README.md","description_en":"Desktop analyzer for recorded radio signals, primarily captures from software-defined radio receivers, which the README says handles files of 100 GB and more. A zoomable spectrogram with a tunable filter feeds sample, amplitude, frequency, phase and threshold plots, and cursors measure period and symbol rate and extract symbol values to stdout or the clipboard. Selected time spans, filtered samples and demodulated traces can be exported, and SigMF annotations can be displayed over the spectrogram.","description_zh":"用于分析已录制无线电信号的桌面工具，主要面向软件无线电接收机的录制文件，README 称可处理 100 GB 以上的文件。可缩放的频谱瀑布图配有可调滤波器，可派生出采样、幅度、频率、相位和阈值曲线；游标用于测量周期和符号速率，并可将符号值提取到标准输出或剪贴板。选定的时间段、滤波后的采样和解调曲线均可导出，频谱图上还能显示 SigMF 标注。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"pulsar","name":"PULSAR","name_zh":"PULSAR 协议学习研究原型","url":"https://github.com/hgascon/pulsar","evidence_url":"https://github.com/hgascon/pulsar/blob/3c6117818ef24de246bda2cdf12d9caa5c557177/README.md","description_en":"Research prototype by Hugo Gascon and colleagues that learns a model of an unknown network protocol from recorded traffic. Messages extracted from PCAP traces are embedded as token or n-gram vectors, clustered by matrix factorization through the PRISMA R module, and turned into a Markov-chain state model with message templates and rules linking fields to earlier messages, written out as model files and a Graphviz state graph. The same models drive the tool's session simulator and stateful fuzzer, described in the authors' SecureComm 2015 paper; this entry covers only the protocol-learning part.","description_zh":"由 Hugo Gascon 等人开发的研究原型，可从记录下来的流量中学习未知网络协议的模型。它从 PCAP 记录中提取报文，将其嵌入为词元或 n-gram 向量，借助 PRISMA R 模块用矩阵分解进行聚类，再生成马尔可夫链状态模型，以及报文模板和把字段与先前报文关联起来的规则，输出为模型文件和 Graphviz 状态图。同一模型还驱动工具中的会话模拟器和有状态模糊测试器，详见作者 2015 年的 SecureComm 论文；本条目只介绍协议学习部分。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"basefind2","name":"basefind2","name_zh":"basefind2 快速固件基址扫描器","url":"https://github.com/soyersoyer/basefind2","evidence_url":"https://github.com/soyersoyer/basefind2/blob/370d0ddf561bf5626c40740f0cc2088578bc35b2/README.md","description_en":"Python script that estimates the load address of a flat 32-bit little-endian firmware image without brute-forcing every candidate base, building on mncoppola's basefind.py and rbasefind. It searches the gaps between sorted pointer values for a run of consecutive gaps between string offsets, takes each match as a candidate base, and scores it by the share of sampled strings whose rebased address also appears as a pointer. The README's example finds the correct base of one image in about 26 seconds.","description_zh":"一个 Python 脚本，无需暴力枚举每个候选基址即可估算平面 32 位小端固件镜像的加载地址，在 mncoppola 的 basefind.py 和 rbasefind 的基础上改进而来。它在排序后指针值的相邻差值中，查找与一段相邻字符串偏移差值完全相同的连续序列，把每处匹配视为候选基址，再按抽样字符串在重定位后的地址同样作为指针出现的比例为其打分。README 中的示例约用 26 秒找出了一个镜像的正确基址。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"paranoid-deobfuscator","name":"paranoid-deobfuscator","name_zh":"paranoid-deobfuscator 字符串反混淆工具","url":"https://github.com/giacomoferretti/paranoid-deobfuscator","evidence_url":"https://github.com/giacomoferretti/paranoid-deobfuscator/blob/028bd05fd8a74e8110d0e003b39f06d3bf597642/README.md","description_en":"Python command-line tool that recovers the strings hidden by the Paranoid and LSParanoid Android string-obfuscation plugins, so that smali code becomes readable for static analysis. It scans a smali directory for the obfuscator's string-lookup method and encoded chunk array, decodes the chunks with Python ports of the libraries' DeobfuscatorHelper and RandomHelper classes, and rewrites each lookup call in place as a const-string instruction with a marker comment. Helper commands list the recovered strings, save the chunks to a file and decode a single string from saved chunks.","description_zh":"一个 Python 命令行工具，用于还原被 Paranoid 和 LSParanoid 这两款 Android 字符串混淆插件隐藏的字符串，使 smali 代码便于静态分析。它在 smali 目录中查找混淆器的字符串查询方法和编码后的分块数组，用移植自这两个库 DeobfuscatorHelper 和 RandomHelper 类的 Python 实现解码分块，并就地把每处查询调用改写为带标记注释的 const-string 指令。辅助命令可列出还原的字符串、把分块保存到文件，以及根据已保存的分块解码单个字符串。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"ghidrathon","name":"Ghidrathon","name_zh":"Ghidrathon Ghidra Python 3 脚本扩展","url":"https://github.com/mandiant/Ghidrathon","evidence_url":"https://github.com/mandiant/Ghidrathon/blob/56866ad97ab7cc207ce85542c5ec20e01a10352d/README.md","description_en":"Mandiant FLARE's Ghidra extension that embeds the user's local CPython 3 interpreter in Ghidra through Jep, as an alternative to Ghidra's Jython-based Python 2.7 scripting. It adds an interactive Python 3 interpreter window, Python 3 scripts in the Script Manager and Python 3 post-scripts in headless analyzeHeadless runs, with GhidraScript state such as currentProgram() and FlatProgramAPI methods available as Python builtins. Because the configured interpreter or virtual environment is used as is, scripts can import installed packages; the README names capa, Unicorn and angr as motivating examples and shows Unicorn emulating ARM code inside Ghidra.","description_zh":"Mandiant FLARE 团队开发的 Ghidra 扩展，借助 Jep 把用户本机的 CPython 3 解释器嵌入 Ghidra，作为 Ghidra 基于 Jython 的 Python 2.7 脚本支持之外的选择。它提供交互式 Python 3 解释器窗口，可在脚本管理器中编写和运行 Python 3 脚本，也可在无界面的 analyzeHeadless 运行中执行 Python 3 后处理脚本；currentProgram() 等 GhidraScript 状态和 FlatProgramAPI 方法以 Python 内置名称的形式提供。由于直接使用所配置的解释器或虚拟环境，脚本可以导入其中已安装的包；README 以 capa、Unicorn 和 angr 为开发动机举例，并演示在 Ghidra 内用 Unicorn 模拟执行 ARM 代码。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"ford-fiesta-mk5-ms-can-case","name":"Ford Fiesta MK5 MS-CAN: decoding the dashboard and radio bus","name_zh":"Ford Fiesta MK5 MS-CAN：解码仪表盘与收音机总线","url":"https://github.com/roncapat/Ford-Fiesta-MK5-MS-CAN-bus","evidence_url":"https://github.com/roncapat/Ford-Fiesta-MK5-MS-CAN-bus/blob/7b57901e7ea6a293aacb692c1895110b2ec7175c/README.md","description_en":"Documents the medium-speed CAN bus that links the 6000CD radio and the dashboard of a restyled (post-2006) Ford Fiesta MK5, worked out by tapping the bus at the radio's QuadLock connector with a Seeed CAN-BUS Shield on an Arduino Uno. The README describes 18 partly or fully decoded message IDs on the 125 kbit/s bus, with byte layouts and scaling formulas: radio text sent to the dashboard LCD over ISO-TP, station names, volume, CD track and steering-column mode and seek buttons, as well as broadcast clock, door, lock, reverse-gear, indicator, light, handbrake, airbag-lamp, pedal, RPM, speed, coolant, key-position, battery and partial VIN data. An incomplete Kayak .kcd definition encodes only the clock and gas-pedal/RPM/speed messages.","description_zh":"记录了改款（2006 年后）Ford Fiesta MK5 上连接 6000CD 收音机与仪表盘的中速 CAN 总线。作者在收音机的 QuadLock 连接器处用 Arduino Uno 加 Seeed CAN-BUS Shield 接入总线，据此推断出这些内容。README 描述了这条 125 kbit/s 总线上 18 个已部分或完全解码的报文 ID，给出字节布局和换算公式：包括收音机经 ISO-TP 发往仪表 LCD 的文字、电台名称、音量、CD 曲目以及转向柱旁的模式与搜台按键，还有广播的时钟、车门、门锁、倒挡、转向灯、灯光、手刹、安全气囊指示灯、踏板、转速、车速、冷却液温度、钥匙位置、蓄电池电压和部分 VIN 数据。附带的 Kayak .kcd 定义文件尚不完整，只编码了时钟和油门踏板／转速／车速两条报文。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"katalina","name":"Katalina","name_zh":"Katalina Dalvik 字节码模拟器","url":"https://github.com/huuck/Katalina","evidence_url":"https://github.com/huuck/Katalina/blob/f8e27b9f9d2316579a22fd1e330c7b385e6de995/README.md","description_en":"Python emulator for Dalvik bytecode that its README likens to Unicorn: it parses a DEX file and executes methods one instruction at a time, substituting Python mocks for common Java and Android APIs such as String, StringBuilder, Base64, ArrayList, AES Cipher and part of reflection. Run over Android entry points, methods matching a name or one method with given arguments, it logs the strings that the code builds or decrypts, optionally as JSON, which helps recover obfuscated strings in apps and malware.","description_zh":"用 Python 编写的 Dalvik 字节码模拟器，README 将其比作面向 Dalvik 的 Unicorn：它解析 DEX 文件并逐条指令执行方法，用 Python 模拟实现替代 String、StringBuilder、Base64、ArrayList、AES Cipher 及部分反射等常见 Java 与 Android API。它可针对 Android 入口点、名称匹配的方法或带指定参数的单个方法运行，记录代码构造或解密出的字符串，并可输出为 JSON，有助于还原应用和恶意软件中被混淆的字符串。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"distorm","name":"diStorm3","name_zh":"diStorm3 x86/AMD64 反汇编库","url":"https://github.com/gdabah/distorm","evidence_url":"https://github.com/gdabah/distorm/blob/7a02caa1a936f0a653fc75f1aaea9bd3fa654603/README.md","description_en":"Lightweight x86/AMD64 disassembler library in C that the README describes as a decomposer: besides formatted text, distorm_decompose returns a binary structure per instruction with its opcode, operands, prefixes, flow-control class and optionally affected CPU flags. It decodes 16-, 32- and 64-bit code, can stop at calls, returns, branches, interrupts or privileged instructions, and its generated instruction tables cover integer, x87, MMX, 3DNow!, SSE through SSE4.2 and SSE4a, AVX, FMA, AES, CLMUL, VMX and SVM sets. The repository includes the distorm3 Python module, plus example Java and .NET wrappers and sample programs for Linux, Win32 and a Windows kernel driver.","description_zh":"轻量级的 x86/AMD64 C 语言反汇编库，README 称其为“分解器”：除格式化文本外，distorm_decompose 还会为每条指令返回一个二进制结构，描述其操作码、操作数、前缀、控制流类别，并可选地给出受影响的 CPU 标志位。它可解码 16、32 和 64 位代码，可在遇到调用、返回、分支、中断或特权指令时停止，其生成的指令表涵盖整数、x87、MMX、3DNow!、SSE 至 SSE4.2 和 SSE4a、AVX、FMA、AES、CLMUL、VMX 及 SVM 指令集。仓库还包含 distorm3 Python 模块，以及 Java 和 .NET 的示例封装和面向 Linux、Win32 及 Windows 内核驱动的示例程序。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"jtagulator","name":"JTAGulator","name_zh":"JTAGulator 片上调试接口识别工具","url":"https://github.com/grandideastudio/jtagulator","evidence_url":"https://github.com/grandideastudio/jtagulator/blob/6a764cd87315e7823937811a5e6f11051c51be1a/README.markdown","description_en":"Joe Grand's open-source hardware tool and Parallax Propeller firmware for locating on-chip debug interfaces among an unfamiliar board's test points, vias, component pads or connectors. Driven from a serial terminal, its 24 level-shifted channels try pin permutations to identify JTAG pinouts by IDCODE or BYPASS scans, SWD pinouts by IDCODE and UART pinouts with their baud rates. With a known JTAG pinout the firmware can also read device IDs, discover instruction and data registers and map a chip's pins to boundary-scan positions with EXTEST, and other modes pass UART traffic through, act as a SUMP-compatible logic analyzer or emulate a Bus Pirate so OpenOCD can use the board as a JTAG adapter.","description_zh":"Joe Grand 开发的开源硬件工具及其 Parallax Propeller 固件，用于在陌生电路板的测试点、过孔、元件焊盘或连接器中找出片上调试接口。它通过串口终端操作，用 24 路电平转换通道逐一尝试引脚排列：以 IDCODE 或 BYPASS 扫描识别 JTAG 引脚，以 IDCODE 识别 SWD 引脚，并识别 UART 引脚及其波特率。已知 JTAG 引脚后，固件还能读取器件 ID、探测指令寄存器和数据寄存器，并用 EXTEST 把芯片引脚对应到边界扫描寄存器中的位置；其他模式可透传 UART 数据、充当兼容 SUMP 的逻辑分析仪，或模拟 Bus Pirate，让 OpenOCD 把它当作 JTAG 适配器使用。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"canlab","name":"CanLab","name_zh":"CanLab CAN 总线逆向分析工作站","url":"https://github.com/Sherin-SEF-AI/CanLab","evidence_url":"https://github.com/Sherin-SEF-AI/CanLab/blob/8aaa6fff2bdfb1099574661c415a7d07a3a6a3de/README.md","description_en":"PyQt6 desktop workstation and command-line tool for reverse-engineering CAN bus captures offline. It reads SavvyCAN/GVRET CSV, candump, pcap, Vector BLF/ASC, MDF4 and openpilot logs, then suggests counters, checksums and their algorithms, byte roles, flags, multiplexers, entropy-based field boundaries and cross-ID correlations, decodes J1939 and NMEA 2000 PGNs and reassembles multi-frame messages. A cantools-backed DBC builder checks signal definitions against the captured frames and exports DBC, openpilot DBC, CANdb++, ARXML and Wireshark Lua dissectors, and an optional MCP server offers 29 receive-only analysis tools to assistants.","description_zh":"用于离线逆向分析 CAN 总线抓包的 PyQt6 桌面工作站及命令行工具。它可读取 SavvyCAN/GVRET CSV、candump、pcap、Vector BLF/ASC、MDF4 和 openpilot 日志，进而提示计数器、校验和及其算法、字节角色、标志位、多路复用器、基于熵的字段边界和跨 ID 相关性，解码 J1939 与 NMEA 2000 PGN，并重组多帧报文。基于 cantools 的 DBC 构建器会用抓取的帧核对信号定义，可导出 DBC、openpilot DBC、CANdb++、ARXML 和 Wireshark Lua 解析器；可选的 MCP 服务器向 AI 助手提供 29 个只接收、不发送的分析工具。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"facedancer","name":"Facedancer","name_zh":"Facedancer USB 设备仿真与代理库","url":"https://github.com/greatscottgadgets/facedancer","evidence_url":"https://github.com/greatscottgadgets/facedancer/blob/9f1298856e8ec6871cca995ded3076ab89dd72cd/README.md","description_en":"Python library for implementing USB devices in software, with a hardware peripheral such as Cynthion or GreatFET acting as a remote-controlled USB controller attached to the target host. Its USBProxy mode sits between a real device and a host, forwarding transfers while filters log, decode or modify them for USB protocol analysis; the README notes this suits devices whose software you do not control, such as embedded systems or game consoles. Version 3 is a ground-up rewrite of the emulation core that ships keyboard, mass-storage and FTDI serial device models plus HID and logging proxy filters, and no longer runs legacy 2.9.x scripts.","description_zh":"用软件实现 USB 设备的 Python 库，借助 Cynthion、GreatFET 等硬件外设充当连接目标主机的可远程控制 USB 控制器。其 USBProxy 模式位于真实设备与主机之间转发传输，并由过滤器记录、解码或修改传输内容，用于 USB 协议分析；README 指出，这适用于无法控制其软件的设备，例如嵌入式系统或游戏主机。第 3 版从头重写了仿真核心，内置键盘、大容量存储和 FTDI 串口设备模型以及 HID 与日志代理过滤器，不再支持旧版 2.9.x 脚本。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"doldrums","name":"Doldrums","name_zh":"Doldrums Flutter/Dart 快照解析器","url":"https://github.com/rscloura/Doldrums","evidence_url":"https://github.com/rscloura/Doldrums/blob/7430196818673ca5c5e10d65685e2b4a8de38dbb/README.md","description_en":"Python parser for the Dart AOT snapshots inside libapp.so, the compiled Dart code of an Android Flutter app. It finds the VM and isolate snapshot symbols with pyelftools, deserializes the snapshot clusters and writes a text dump of every class in the isolate snapshot, with fields, method signatures and each method's absolute code offset in libapp.so. It recovers declarations and offsets for further disassembly, not decompiled function bodies.","description_zh":"用 Python 编写的解析器，处理 Android Flutter 应用中存放编译后 Dart 代码的 libapp.so 里的 Dart AOT 快照。它借助 pyelftools 定位 VM 与 isolate 快照符号，反序列化快照中的各个簇（cluster），并把 isolate 快照中的全部类导出为文本，列出字段、方法签名以及每个方法在 libapp.so 中的绝对代码偏移。它恢复的是声明和偏移，供进一步反汇编使用，并不反编译函数体。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-27"},{"id":"biosutilities","name":"BIOSUtilities","name_zh":"BIOSUtilities 厂商 BIOS/UEFI 更新包提取工具集","url":"https://github.com/platomav/BIOSUtilities","evidence_url":"https://github.com/platomav/BIOSUtilities/blob/f799425af93264b62a2f3c3cc5bbabf8a2226114/README.md","description_en":"Python collection of 16 parsers and extractors for vendor BIOS/UEFI update formats, including AMI BIOS Guard (PFAT) and UCP, Dell PFS, Insyde iFlash/iFdPacker, Phoenix TDK Packer, Award, Fujitsu, Panasonic, Portwell, Toshiba and VAIO packages and several Apple EFI containers. Each utility checks whether an input matches its format and unpacks the firmware components, such as SPI/BIOS/UEFI, EC and ME images, plus bundled utilities into an output folder, optionally reporting structure information; an Apple EFI identifier names images from their IBIOSI tag. A main.py script tries every utility on the given files, and the biosutilities package exposes the same classes to Python.","description_zh":"用 Python 编写的厂商 BIOS/UEFI 更新格式解析与提取工具集，共 16 个工具，涵盖 AMI BIOS Guard（PFAT）与 UCP、Dell PFS、Insyde iFlash/iFdPacker、Phoenix TDK Packer、Award、富士通、松下、Portwell、东芝和 VAIO 的更新包，以及多种 Apple EFI 容器。每个工具先判断输入是否属于其格式，再将固件组件（如 SPI/BIOS/UEFI、EC、ME 镜像）及随附的实用程序解包到输出目录，并可选输出结构信息；Apple EFI 识别工具则依据 IBIOSI 标签为镜像命名。main.py 脚本会对给定文件依次尝试所有工具，biosutilities 软件包也向 Python 程序提供同样的类。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"allyourbase","name":"allyourbase","name_zh":"allyourbase 固件基址估算脚本","url":"https://github.com/8051Enthusiast/allyourbase","evidence_url":"https://github.com/8051Enthusiast/allyourbase/blob/78e98f7a592c5bfdb52590bdd26139202b602100/README.md","description_en":"Python script that estimates a firmware image's base address by comparing string addresses with the targets of every possible pointer, for any pointer size and either endianness. Instead of trying each base in turn, it computes the overlap as an FFT cross-correlation modulo several pairwise-coprime numbers and recovers the base with the Chinese remainder theorem, which keeps 64-bit address spaces tractable. The author keeps it small so that analysts can swap in their own heuristic, such as matching absolute call targets with the instructions that follow returns.","description_zh":"一个 Python 脚本，通过比较字符串地址与每个可能指针的目标地址来估算固件镜像的基址，支持任意指针长度和两种字节序。它不逐个尝试基址，而是在几个两两互素的模数下用 FFT 计算互相关来衡量重叠程度，再用中国剩余定理还原基址，因此也能处理 64 位地址空间。作者有意保持代码简短，方便分析者换用自己的启发式方法，例如把绝对调用的目标与返回指令之后的位置对应起来。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"ghidra-kernelcache","name":"ghidra_kernelcache","name_zh":"ghidra_kernelcache Apple 内核缓存分析框架","url":"https://github.com/0x36/ghidra_kernelcache","evidence_url":"https://github.com/0x36/ghidra_kernelcache/blob/b0961b3cdfb96e8b86c89d73fdedf84affc01c77/README.md","description_en":"Ghidra script framework for reverse engineering Apple kernelcaches and kernel extensions on iOS and macOS. Starting from the C++ class information that Siguza's iometa extracts, it symbolicates the kernel, rebuilds IOKit class hierarchies, structures, namespaces and virtual tables with typed method definitions, and resolves virtual call references, either through arm64e pointer-authentication constants or with a p-code data-flow pass. Other scripts fix the externalMethod and getTargetAndMethodForIndex dispatch tables, apply XNU function signatures from header files, propagate types, load KDK DWARF symbols and copy structures between projects.","description_zh":"用于逆向分析 iOS 与 macOS 上 Apple kernelcache 和内核扩展的 Ghidra 脚本框架。它以 Siguza 的 iometa 提取的 C++ 类信息为起点，为内核恢复符号，重建 IOKit 类层次、结构体、命名空间和带类型方法定义的虚表，并通过 arm64e 指针认证常量或基于 p-code 的数据流分析解析虚函数调用引用。其他脚本可修复 externalMethod 和 getTargetAndMethodForIndex 分派表、根据头文件应用 XNU 函数签名、传播类型、加载 KDK 的 DWARF 符号，以及在项目之间复制结构体定义。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-27"},{"id":"probedroid","name":"ProbeDroid","name_zh":"ProbeDroid Android 动态插桩工具包","url":"https://github.com/ZSShen/ProbeDroid","evidence_url":"https://github.com/ZSShen/ProbeDroid/blob/a6dc602bc59ecd9a4398a10cfe0e27e91bc2ab7c/README.md","description_en":"Dynamic Java-method instrumentation kit for Android 5.0 that lets analysts write their own tracing and profiling tools for apps whose source code they do not have. A launcher uses ptrace to inject the native engine library and a user-built instrumentation APK into a newly started target app, and the tool subclasses the Instrument API to hook framework or app-defined Java methods and inspect or change their arguments and return values. The README's demos use sample tools that log strings built through StringBuilder and StringBuffer and the activities and services an app starts.","description_zh":"面向 Android 5.0 的 Java 方法动态插桩工具包，让分析人员在没有应用源码的情况下自行编写跟踪和性能分析工具。启动器通过 ptrace 把原生引擎库和用户构建的插桩 APK 注入新启动的目标应用；插桩工具继承 Instrument API，钩挂系统框架或应用自定义的 Java 方法，查看或修改其参数与返回值。README 的演示使用示例工具，记录经 StringBuilder 和 StringBuffer 构造的字符串，以及应用启动的 Activity 和 Service。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"fridump","name":"Fridump","name_zh":"Fridump 基于 Frida 的进程内存转储工具","url":"https://github.com/Nightbringer21/fridump","evidence_url":"https://github.com/Nightbringer21/fridump/blob/3e64ee0b0e3dbd7e1aa295077c9ba0728a2bc68f/README.md","description_en":"Small Python command-line tool that attaches to a running process through Frida and writes its accessible memory ranges to files, run from a Windows, Linux or macOS host against iOS, Android or Windows applications. By default it saves ranges that are readable and writable, -r also takes read-only ones, ranges above a size limit (20 MiB unless set with --max-size) are split into chunks, and -s runs a basic strings pass that collects printable text from every dump into strings.txt. Its README presents it for penetration testers and developers.","description_zh":"一个小型 Python 命令行工具，通过 Frida 附加到正在运行的进程，把其中可访问的内存区域写入文件；可在 Windows、Linux 或 macOS 主机上运行，面向 iOS、Android 或 Windows 应用。默认只保存可读写的内存区域，-r 会连同只读区域一并保存；超过大小上限（默认 20 MiB，可用 --max-size 调整）的区域会拆分成多块；-s 会对所有转储文件做一遍简单的字符串提取，把可打印文本汇总到 strings.txt。其 README 称该工具主要面向渗透测试人员和开发者。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-27"},{"id":"frida-ui","name":"Frida UI","name_zh":"Frida UI 浏览器端 Frida 操作界面","url":"https://github.com/adityatelange/frida-ui","evidence_url":"https://github.com/adityatelange/frida-ui/blob/4b25e28013bd142c7ef80462491e4db31d3c143f/README.md","description_en":"Local browser interface for Frida aimed at Android app testing: a FastAPI server lists USB, local and remote frida-server devices with their installed apps and running processes, and lets the analyst attach to a process, spawn an app, spawn it with a script injected at launch, detach or kill it. Scripts are written in a Monaco editor or loaded from files or Frida CodeShare, whose scripts can be queued to run at spawn, and each session's console output is kept and can be exported as text.","description_zh":"面向 Android 应用测试的 Frida 本地浏览器界面：FastAPI 服务会列出通过 USB、本机或远程 frida-server 连接的设备，以及其中已安装的应用和正在运行的进程，分析者可在浏览器中附加到进程、启动应用、在启动时注入脚本，或断开、结束进程。脚本可在 Monaco 编辑器中编写，也可从本地文件或 Frida CodeShare 载入，CodeShare 脚本可排队在启动时运行；每个会话的控制台输出都会保留，并可导出为文本。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"darter","name":"darter","name_zh":"darter Dart 快照解析器","url":"https://github.com/mildsunrise/darter","evidence_url":"https://github.com/mildsunrise/darter/blob/a6498786ed0f96b2b70635f008fee62dc07796da/README.md","description_en":"Python module that parses binary Dart VM snapshots, such as the libapp.so of a release Flutter app, into a navigable graph of VM objects with back-references, including the memory structures the snapshot dumps. It reads old, AppJIT and AppAOT snapshots, usually autodetects flags and settings from the snapshot itself, extracts the snapshot blobs from app.so or .snapshot files, and its darter.asm module disassembles ARM and ARM64 code with Capstone to find references to VM objects. The README's examples include extracting an app's string table, finding where an object is used, generating call and library-dependency graphs, exporting metadata for Radare2 and deobfuscating a snapshot by matching it against a reference one.","description_zh":"用于解析二进制 Dart VM 快照（例如 Flutter 发布版应用中的 libapp.so）的 Python 模块，可把快照内容还原为带反向引用、便于浏览的 VM 对象图，连同快照中转储的内存结构一并解析。它支持旧式、AppJIT 和 AppAOT 三类快照，通常能从快照本身自动识别编译标志和设置，可从 app.so 或 .snapshot 文件中自动提取快照数据块；其 darter.asm 模块借助 Capstone 反汇编 ARM 和 ARM64 代码，查找其中对 VM 对象的引用。README 列举的用法包括提取应用的字符串表、查找某个对象在何处被使用、生成调用图和库依赖图、为 Radare2 导出元数据，以及与参考快照比对来对快照去混淆。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-27"},{"id":"tocode","name":"ToCode","name_zh":"ToCode 面向智能体的二进制类源码导出工具","url":"https://github.com/buzzer-re/ToCode","evidence_url":"https://github.com/buzzer-re/ToCode/blob/216f1f9d808f0c125ef5edb5652021e9c3c96f51/README.md","description_en":"Python CLI that exports a binary, IDA database, Android APK, .NET assembly or whole application folder into a source-like project tree for coding agents: recovered C (Java for APKs, C# and IL for .NET) with matching assembly and function summaries, recovered headers and types, section dumps, JSON indexes of functions, strings, imports, exports, reachability and call-graph clusters, and generated AGENTS.md and CLAUDE.md files. It drives IDA, Binary Ninja, radare2 with r2ghidra or angr, and for folders links each import to the defining file's function using the platform's loader rules. Its tocode mcp server keeps the decompiler open so an agent can record names, types and comments and re-render only the affected files.","description_zh":"一个 Python 命令行工具，可把二进制、IDA 数据库、Android APK、.NET 程序集或整个应用目录导出为供编码智能体阅读的类源码项目树：还原的 C 代码（APK 为 Java，.NET 为 C# 和 IL）及对应汇编与函数摘要、还原的头文件和类型、节区数据转储，函数、字符串、导入、导出、可达性和调用图聚类的 JSON 索引，以及生成的 AGENTS.md 和 CLAUDE.md。它可调用 IDA、Binary Ninja、配合 r2ghidra 的 radare2 或 angr；处理目录时按各平台加载器规则，把每个导入项链接到定义它的文件中的函数。其 tocode mcp 服务会保持反编译器打开，让智能体记录名称、类型和注释，并只重新生成受影响的文件。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["app","binary"],"verified_at":"2026-10-27"},{"id":"esp32-image-parser","name":"esp32_image_parser","name_zh":"esp32_image_parser ESP32 固件镜像解析工具","url":"https://github.com/tenable/esp32_image_parser","evidence_url":"https://github.com/tenable/esp32_image_parser/blob/0c9ff48d56c8e1e65ba93213400b4d469b84c8ce/README.md","description_en":"Tenable's Python command-line tool, described in its repository as a toolkit for reverse engineering ESP32 firmware, that reads the partition table of an ESP32 flash dump and rebuilds an app partition such as factory or ota_0 as an Xtensa ELF file. Other actions list the partitions, dump a partition's raw bytes and parse an NVS partition's key-value entries as text or JSON; create_elf loads the app image with esptool, maps its flash, DRAM and IRAM segments to ELF sections and adds symbols from a bundled ROM symbol table.","description_zh":"Tenable 发布的 Python 命令行工具，其仓库简介称之为辅助逆向 ESP32 固件的工具包：它读取 ESP32 闪存转储中的分区表，并将 factory、ota_0 等应用分区重建为 Xtensa ELF 文件。其他操作可列出分区、导出某个分区的原始字节，并将 NVS 分区的键值条目解析为文本或 JSON；create_elf 借助 esptool 载入应用镜像，把其中的闪存、DRAM 和 IRAM 段映射为 ELF 节区，并加入仓库自带 ROM 符号表中的符号。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"mirage-wireless-framework","name":"Mirage","name_zh":"Mirage 无线通信分析框架","url":"https://github.com/RCayre/mirage","evidence_url":"https://github.com/RCayre/mirage/blob/b6cd39eb779a94a11ebf9f7cba4e77435d885434/readme.md","description_en":"Python framework from IoT-security research at LAAS-CNRS for analysing wireless communications, with lightweight protocol stacks for Bluetooth Low Energy, Bluetooth, Enhanced ShockBurst, Mosart, Zigbee, Wi-Fi and infrared that a command-line interpreter drives through chainable modules. For protocol analysis it offers per-protocol scan, information and sniffing modules, BLE ATT/GATT discovery that saves the discovered attribute table, HCI monitoring of an Android phone through its btsnoop log over ADB, PCAP reading and writing, and an experimental HackRF software-radio receive path with FSK demodulators and BLE and Zigbee decoders. Its author has deprecated it in favour of the WHAD tool suite.","description_zh":"源自 LAAS-CNRS 物联网安全研究的 Python 无线通信分析框架，内置低功耗蓝牙（BLE）、经典蓝牙、Enhanced ShockBurst、Mosart、Zigbee、Wi-Fi 和红外等轻量协议栈，由命令行解释器调用可串联的模块。用于协议分析时，它为各协议提供扫描、信息查询和嗅探模块，可发现 BLE 的 ATT/GATT 层并保存所得属性表，可通过 ADB 读取 Android 手机的 btsnoop 日志来监视 HCI 通信，支持读写 PCAP，并提供基于 HackRF 的实验性软件无线电接收路径，包含 FSK 解调器以及 BLE 和 Zigbee 解码器。作者已宣布弃用该项目，转而开发 WHAD 工具集。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"uniden-r8-ble-telemetry-case","name":"uniden-r8-ble: reconstructing the Uniden R8 radar detector's BLE telemetry","name_zh":"uniden-r8-ble：重建 Uniden R8 雷达探测器的蓝牙遥测","url":"https://github.com/JeremyWhittaker/unidenr8_bluetooth","evidence_url":"https://github.com/JeremyWhittaker/unidenr8_bluetooth/blob/46c7e1af2fa86c9a5c18f58528bea0f22b4d77dc/docs/PROTOCOL.md","description_en":"Decodes the undocumented Bluetooth Low Energy output of a Uniden R8 radar detector into a receive-only collector for a Raspberry Pi, with live telemetry, alert start/update/end events, SQLite history and optional MQTT and Home Assistant publishing. The author worked the protocol out from the wire on a real detector, building on earlier R8w findings from AegisX86/UnidenR8wlink, and grades every claim in PROTOCOL.md by its evidence: measured on this R8, seen on another model, decompiled from an app but untested, or inference. Unknown fields are carried through raw rather than given invented meanings.","description_zh":"将 Uniden R8 雷达探测器未公开的低功耗蓝牙输出解码为可在 Raspberry Pi 上运行的只读采集程序，提供实时遥测、警报开始／更新／结束事件、SQLite 历史记录，以及可选的 MQTT 与 Home Assistant 发布。作者在真实设备上直接从通信数据推断协议，并以 AegisX86/UnidenR8wlink 先前针对 R8w 的发现为基础；PROTOCOL.md 中的每项结论都按证据分级：在这台 R8 上实测、在其他型号上见到、从应用反编译但未测试，或推断。未知字段按原始数据保留，而不赋予臆造的含义。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"redress","name":"Redress","name_zh":"Redress Go 二进制分析工具","url":"https://github.com/goretk/redress","evidence_url":"https://github.com/goretk/redress/blob/fe38d961b5d8bf0a0ebf58421527da64422a7922/README.md","description_en":"Command-line tool, built on the GoRE library, that recovers metadata from stripped binaries produced by the Go compiler. It reports the compiler version, build ID, GOROOT, main-package path and Go module information; lists project, standard-library and vendored packages; prints interfaces, structs and their methods as Go type declarations; and projects the source tree as packages, files and functions with estimated line ranges. Run inside radare2 through r2pipe, it adds function and type flags and analyzes main.init and main.main.","description_zh":"基于 GoRE 库的命令行工具，可从 Go 编译器生成、已剥离符号的二进制文件中恢复元数据。它能报告编译器版本、构建 ID、GOROOT、main 包路径和 Go 模块信息；列出项目包、标准库包和 vendor 包；把接口、结构体及其方法输出为 Go 类型声明；并按包、文件和函数推测源码树布局，估计各函数的行号范围。通过 r2pipe 在 radare2 中运行时，它会为函数和类型添加标记，并分析 main.init 与 main.main。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"ghidra-nanomips","name":"ghidra-nanomips","name_zh":"ghidra-nanomips nanoMIPS 处理器模块","url":"https://github.com/nccgroup/ghidra-nanomips","evidence_url":"https://github.com/nccgroup/ghidra-nanomips/blob/62ebe71bb858dd193bef9bb421e7b9888e140882/README.md","description_en":"Ghidra processor module that adds nanoMIPS disassembly and decompilation through a SLEIGH specification of the little-endian 32-bit nanoMIPS instruction set, including its multithreading instructions. NCC Group's announcement says it was written while reverse engineering MediaTek 5G baseband firmware, implements the instructions met in that firmware and leaves some complex P-Code emulation unimplemented, yet decompiles most of the baseband code the team analyzed.","description_zh":"为 Ghidra 增加 nanoMIPS 反汇编和反编译能力的处理器模块，以 SLEIGH 规范描述小端 32 位 nanoMIPS 指令集，包括其多线程指令。NCC Group 的发布文章称，该模块是在逆向分析 MediaTek 5G 基带固件时编写的，实现了该固件中遇到的指令，部分复杂 P-Code 仿真尚未实现，但已能反编译团队分析过的大部分基带代码。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-27"},{"id":"smda","name":"SMDA","name_zh":"SMDA 递归反汇编库","url":"https://github.com/danielplohmann/smda","evidence_url":"https://github.com/danielplohmann/smda/blob/04652e6662fde57d146a14d80399e2c1d128e26b/README.md","description_en":"Python recursive disassembler library built on Capstone that recovers control-flow graphs from PE, ELF and Mach-O files, .NET assemblies, raw DEX files and memory dumps with a known base address, through x86/x64, AArch64, 32-bit ARM/Thumb, CIL and Dalvik backends. Its JSON reports list functions, basic blocks, instructions and the edges between them, enriched with symbols from imports, exports, PDB, Go, Rust and Delphi metadata, referenced strings, Windows API references inferred with the ApiScout method and position-independent code hashes. Function discovery deliberately favours completeness over precision; the README names SMDA as capa's disassembler backend and MCRIT's code-analysis layer, and IDA Pro or Binary Ninja analyses can be exported into the same report format.","description_zh":"基于 Capstone 的 Python 递归反汇编库，借助 x86/x64、AArch64、32 位 ARM/Thumb、CIL 和 Dalvik 后端，从 PE、ELF、Mach-O 文件、.NET 程序集、原始 DEX 文件以及已知基址的内存转储中恢复控制流图。其 JSON 报告列出函数、基本块、指令及其间的边，并补充来自导入表、导出表、PDB、Go、Rust 与 Delphi 元数据的符号、被引用的字符串、用 ApiScout 方法推断的 Windows API 引用以及位置无关代码哈希。函数发现有意以完整性优先于精确性；README 称 SMDA 是 capa 的反汇编后端和 MCRIT 的代码分析层，IDA Pro 或 Binary Ninja 的分析结果也可导出为同一报告格式。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"willnode-deobfuscator","name":"Javascript Deobfuscator","name_zh":"willnode JavaScript 手动反混淆编辑器","url":"https://github.com/willnode/deobfuscator","evidence_url":"https://github.com/willnode/deobfuscator/blob/313ab0dcc0211e3c662514b4448153963fce22c6/README.md","description_en":"Browser-based workbench for deobfuscating JavaScript by hand, also hosted on GitHub Pages, that pairs a Monaco editor with step-by-step rewriting and evaluation commands instead of a one-click pipeline. Formatting commands beautify the code and, on a selection or the whole file, decode escaped strings, convert hex numbers, turn bracketed property access into dot notation and rename _0x-style identifiers to short names; evaluation commands push declarations onto a code stack, evaluate a selected expression against it and substitute JSON results, replace captured variables automatically and collapse chains of aliases. The README says the process is not automatic and expects the analyst to know JavaScript.","description_zh":"一个在浏览器中手动反混淆 JavaScript 的工作台，也部署在 GitHub Pages 上，以 Monaco 编辑器搭配逐步改写和求值命令，而非一键式流程。格式化命令可美化代码，并对选区或整个文件解码转义字符串、转换十六进制数字、把方括号属性访问改为点号形式、把 _0x 式标识符改为短名称；求值命令可把声明压入代码栈，在其基础上对选中的表达式求值并用 JSON 结果替换，自动替换捕获到的变量，以及合并层层别名。README 说明这一过程并非自动完成，要求分析者熟悉 JavaScript。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-27"},{"id":"icsim","name":"ICSim (Instrument Cluster Simulator)","name_zh":"ICSim 汽车仪表盘 CAN 总线模拟器","url":"https://github.com/zombieCraig/ICSim","evidence_url":"https://github.com/zombieCraig/ICSim/blob/2b3333ef866987d8adc9c15ff15b9b9189edf85b/README.md","description_en":"OpenGarages' Instrument Cluster Simulator for practising CAN bus reverse engineering on a Linux virtual CAN interface instead of a car. One SDL window draws a dashboard whose speedometer, turn signals and door-lock indicators react to the CAN frames it sniffs, while a separate controls program turns gamepad or keyboard input into those frames and replays a recorded sample of generic CAN traffic as background noise. In training mode the arbitration IDs and byte positions behind each signal are randomized from a seed shared by both programs, and the highest difficulty level adds further random data to the target messages, so learners have to find the relevant messages themselves.","description_zh":"OpenGarages 开发的仪表盘模拟器，可在 Linux 虚拟 CAN 接口上练习 CAN 总线逆向分析，而无需真车。一个 SDL 窗口绘制仪表盘，其车速表、转向灯和车门锁指示会根据它监听到的 CAN 帧变化；另一个控制程序把手柄或键盘输入转换成这些帧，并回放一段录制的通用 CAN 流量作为背景噪声。训练模式下，两个程序依据共享的随机种子打乱各信号对应的仲裁 ID 和字节位置，最高难度还会在目标报文中加入额外的随机数据，学习者必须自己找出相关报文。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"nowsecure-frida-trace","name":"frida-trace (NowSecure library)","name_zh":"frida-trace（NowSecure 声明式跟踪库）","url":"https://github.com/nowsecure/frida-trace","evidence_url":"https://github.com/nowsecure/frida-trace/blob/9b92c1762373dcfc7458c34fa8f5826606bbcc8b/README.md","description_en":"JavaScript library for Frida agents that traces native functions from a declarative description: each function is listed with its return type and input and output arguments, including pointers, UTF-8 and UTF-16 strings and byte arrays whose length is bound to another argument or the return value, with conditions such as reading an output pointer only when the call succeeds. It resolves the functions from a module's exports or a vtable, attaches Frida's Interceptor and hands one event per call to callbacks. Helper scripts in the same repository generate trace boilerplate from C headers through libclang.","description_zh":"供 Frida 代理脚本使用的 JavaScript 库，按声明式描述跟踪原生函数：每个函数都列出返回类型及输入、输出参数，参数类型包括指针、UTF-8 与 UTF-16 字符串，以及长度绑定到其他参数或返回值的字节数组，还可设置条件，例如仅在调用成功时读取输出指针。它从模块导出表或虚函数表解析函数，挂接 Frida 的 Interceptor，并为每次调用向回调传递一个事件。同一仓库中的辅助脚本可借助 libclang 从 C 头文件生成跟踪样板代码。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-27"},{"id":"appshark","name":"Appshark","name_zh":"Appshark Android 静态污点分析引擎","url":"https://github.com/bytedance/appshark","evidence_url":"https://github.com/bytedance/appshark/blob/487fa2175c4a6ccbfb5a330b5e3ed0081de3bfeb/README.md","description_en":"ByteDance's static taint-analysis engine for Android APKs, designed for very large apps, that scans an app against JSON rules naming entry methods, sources, sinks and sanitizers as Jimple signatures, for vulnerability and privacy-compliance review. It works on Soot's Jimple IR and reuses FlowDroid's manifest and resource parsing, but implements its own field-sensitive pointer and taint analysis. Results go to results.json, which records app, component and permission information, deep links and JavaScript bridge interfaces alongside each source-to-sink path, with an HTML page per finding.","description_zh":"字节跳动开发的 Android APK 静态污点分析引擎，面向超大型应用设计：它依据 JSON 规则扫描应用，规则以 Jimple 签名指定入口方法、源、汇和净化器，用于漏洞与隐私合规审查。它基于 Soot 的 Jimple 中间表示，并复用 FlowDroid 的清单与资源解析模块，但指针分析和污点分析均为自行实现，且区分字段。结果写入 results.json，其中记录应用、组件和权限信息、深层链接及 JavaScript 桥接接口，以及每条从源到汇的路径，每项发现另有一个 HTML 页面。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"wallbreaker","name":"Wallbreaker","name_zh":"Wallbreaker Java 堆查看工具","url":"https://github.com/hluwa/Wallbreaker","evidence_url":"https://github.com/hluwa/Wallbreaker/blob/f27f2daf2d74c000446a520c8e1c906fb416efb9/README.md","description_en":"Frida-based explorer for the live Java heap of a running Android app, loaded as an objection plugin or used through its small Python package. classsearch and objectsearch find loaded classes by pattern and live instances of a class, returning object handles; classdump prints a class's declared fields, static field values and methods, and objectdump prints an instance's field values, can view it as a superclass and lists every entry of a collection or map. Analysts use it to see the runtime data and concrete implementations that static decompilation leaves open.","description_zh":"基于 Frida 的工具，用于查看正在运行的 Android 应用的实时 Java 堆，可作为 objection 插件加载，也可通过其小型 Python 包调用。classsearch 与 objectsearch 按模式查找已加载的类，或查找某个类的存活实例并返回对象句柄；classdump 打印类声明的字段、静态字段值和方法，objectdump 打印实例的字段值，可将其按父类查看，并列出集合或映射中的全部条目。分析者借此查看静态反编译无法确定的运行时数据和具体实现。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"pawitp-protobuf-decoder","name":"Protobuf Decoder","name_zh":"Protobuf Decoder 无定义 Protobuf 网页解码器","url":"https://github.com/pawitp/protobuf-decoder","evidence_url":"https://github.com/pawitp/protobuf-decoder/blob/7d0b5edecbbbd38c1230ba9301359cc27e373c23/README.md","description_en":"Pawit Pornkitprasan's React web application for decoding Protocol Buffers data without the original .proto files, offered as a hosted page or run locally, with all decoding done in the browser. Pasted hex or base64 input, or an uploaded file, is split into a table of byte ranges, field numbers, wire types and contents: varints are shown as unsigned, two's-complement and zigzag integers, fixed32 and fixed64 values as integers and floating-point numbers, and length-delimited fields as nested messages when they parse cleanly, otherwise as UTF-8 strings or bytes. It skips a leading gRPC message header and can optionally split a stream of varint length-delimited messages.","description_zh":"Pawit Pornkitprasan 开发的 React 网页应用，用于在没有原始 .proto 文件的情况下解码 Protocol Buffers 数据；既有在线托管页面，也可在本地运行，所有解码都在浏览器中完成。粘贴的十六进制或 base64 数据（也可上传文件）会被拆分成表格，列出字节范围、字段编号、线路类型和内容：varint 同时显示为无符号整数、补码整数和 zigzag 编码整数，fixed32 和 fixed64 显示为整数和浮点数，长度分隔字段若能完整解析则显示为嵌套报文，否则显示为 UTF-8 字符串或字节。它会跳过开头的 gRPC 报文头，还可选择按 varint 长度前缀拆分连续的多条报文。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"btd-dnn-decompiler","name":"BTD (Bin To DNN)","name_zh":"BTD（Bin To DNN）DNN 可执行文件反编译器","url":"https://github.com/monkbai/DNN-decompiler","evidence_url":"https://github.com/monkbai/DNN-decompiler/blob/33227a0b34f87c490efc734d667ac56530f5074a/README.md","description_en":"Research artifact for the USENIX Security 2023 paper “Decompiling x86 Deep Neural Network Executables”. BTD decompiles x86 executables emitted by the DNN compilers TVM, Glow and NNFusion into model specifications: operator types, network topology, dimensions and parameters such as weights and biases. It splits IDA disassembly into functions, infers each operator's type with a trained classifier over assembly tokens, records Intel Pin traces filtered by taint analysis, recovers dimensions and parameters with a trace-based symbolic execution engine, then rebuilds the model in PyTorch and compares its output with the original executable.","description_zh":"USENIX Security 2023 论文《Decompiling x86 Deep Neural Network Executables》的研究产物。BTD 将 DNN 编译器 TVM、Glow 和 NNFusion 生成的 x86 可执行文件反编译为模型规格：算子类型、网络拓扑、维度以及权重和偏置等参数。它把 IDA 的反汇编结果拆分为函数，用基于汇编词元训练的分类器推断每个算子的类型，用 Intel Pin 记录执行轨迹并经污点分析过滤，借助基于轨迹的符号执行引擎恢复维度和参数，最后在 PyTorch 中重建模型，并将其输出与原可执行文件对比。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"opendash-scanmatik-sm3-protocol-case","name":"opendash: reconstructing the Scanmatik SM3 J2534 adapter protocol","name_zh":"opendash：重建 Scanmatik SM3 J2534 适配器协议","url":"https://github.com/PabloSoage/opendash","evidence_url":"https://github.com/PabloSoage/opendash/blob/7c8d72953d8060f2dc49e606963e1d103eec64d9/docs/protocol.md","description_en":"Speaks the undocumented protocol of the Scanmatik SM3, a J2534 vehicle interface that otherwise talks only to its own Windows software, and exposes it to an Android phone as an ELM327 bridge with a diagnostics app on top. The author recovered the framing — a 16-byte header with sequence, CRC-based and sum-based check words, opcode and length — by capturing the device's bundled driver and measuring the replies, and docs/protocol.md separates what was established from what is still open. Reported results come from one Opel Astra J over five sessions with the car present.","description_zh":"直接使用 Scanmatik SM3 未公开的协议——这款 J2534 车辆接口原本只与自家 Windows 软件通信——并以 ELM327 桥接的形式提供给 Android 手机，其上还有一个诊断应用。作者通过抓取设备随附驱动的通信并测量响应，恢复了报文结构：包含序号、基于 CRC 与求和的校验字、操作码和长度的 16 字节报头；docs/protocol.md 区分了已确认与仍待解决的部分。所报告的结果来自一辆 Opel Astra J、共五次有车在场的测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"reverse-api-engineer","name":"Reverse API Engineer","name_zh":"Reverse API Engineer 网站 API 客户端生成智能体","url":"https://github.com/kalil0321/reverse-api-engineer","evidence_url":"https://github.com/kalil0321/reverse-api-engineer/blob/4e150176ec7c50c960d23e35bd3d2c5b82931528/README.md","description_en":"Python CLI that turns the HTTP traffic a website actually produces into a typed API client. A browser session, driven by the user through Playwright or by an AI agent through Playwright or Chrome DevTools MCP servers or Vercel's agent-browser CLI, is recorded to a HAR file; a coding agent run through the Claude Agent SDK, OpenCode, Cursor or GitHub Copilot then reads the capture and writes a client, README and usage example in one of ten languages. A separate collector mode gathers structured JSON/CSV data with web search and fetch.","description_zh":"把网站实际产生的 HTTP 流量转换为带类型 API 客户端的 Python 命令行工具。浏览器会话可由用户通过 Playwright 操作，也可由 AI 智能体借助 Playwright 或 Chrome DevTools MCP 服务、或 Vercel 的 agent-browser 命令行来驱动，并记录为 HAR 文件；随后由经 Claude Agent SDK、OpenCode、Cursor 或 GitHub Copilot 运行的编码智能体读取该记录，以十种语言之一编写客户端、README 和用法示例。另有独立的 collector 模式，借助网页搜索与抓取收集 JSON/CSV 结构化数据。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["website"],"verified_at":"2026-10-27"},{"id":"go-fast-js-ast","name":"go-fAST","name_zh":"go-fAST JavaScript 语法树库","url":"https://github.com/T14Raptor/go-fAST","evidence_url":"https://github.com/T14Raptor/go-fAST/blob/379695448820483158b38ed4e6860d347fc5fccc/README.md","description_en":"Go library for parsing, traversing, transforming and regenerating JavaScript abstract syntax trees, which its README presents for code analysis, obfuscation and deobfuscation. Its parser builds on goja's parsing code, a generated SWC-style visitor API supports depth-first rewriting and cloning of nodes, a resolver tracks scopes and bindings, the ext package adds node-removal, side-effect and value-inference helpers, and a generator prints JavaScript from the tree. The documentation calls it a lightweight, faster alternative to Babel that deliberately omits parent, sibling and reference maps and automated mutation helpers.","description_zh":"一个用 Go 编写的库，用于解析、遍历、转换和重新生成 JavaScript 抽象语法树，README 将其定位于代码分析以及混淆与反混淆。其解析器基于 goja 的解析代码，自动生成的 SWC 式访问者 API 支持深度优先地改写和克隆节点，解析器（resolver）跟踪作用域与绑定，ext 包提供删除节点、判断副作用和推断取值的辅助函数，代码生成器则从语法树输出 JavaScript。文档称它是比 Babel 更轻、更快的替代品，并刻意省去了父节点、兄弟节点和引用映射以及自动化的修改辅助功能。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-27"},{"id":"openbaud-serial-device-mcp","name":"OpenBaud","name_zh":"OpenBaud 串口设备 MCP 服务器","url":"https://github.com/Leonezz/openbaud","evidence_url":"https://github.com/Leonezz/openbaud/blob/f3ebd8976ebeae071dbfb95a1f09c58204bbd57f/README.md","description_en":"Rust MCP server and Codex plugin that gives coding agents audited access to local serial devices, from identifying ports by USB metadata and sending framed requests to recording every received and transmitted byte in lossless .obcap captures. Device behaviour confirmed during exploration is kept as YAML device profiles, typed commands and workflows that validate checksums and decode scalars, bit fields and record arrays, and the same commands can be replayed against a capture without hardware. Its worked demo decodes OBP/1, a small binary protocol the author wrote for an ESP32-S3 test board, not an existing vendor protocol.","description_zh":"以 Rust 编写的 MCP 服务器兼 Codex 插件，为编程智能体提供可审计的本地串口设备访问：按 USB 元数据识别端口、发送分帧请求，并把收发的每个字节记录到无损的 .obcap 捕获文件中。探索中确认的设备行为保存为 YAML 设备配置、类型化命令和工作流，可校验校验和并解码标量、位字段和记录数组；同样的命令还能在没有硬件时对捕获文件重放。其完整演示解码的是作者为 ESP32-S3 测试板编写的小型二进制协议 OBP/1，而非现有的厂商协议。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"tigard","name":"Tigard","name_zh":"Tigard 多协议硬件接口板","url":"https://github.com/tigard-tools/tigard","evidence_url":"https://github.com/tigard-tools/tigard/blob/0dd58e710374880a3ae988f2ddfeb46f5ec8061d/README.md","description_en":"Open-hardware board built around the FTDI FT2232H that connects a computer to a target device's UART, SPI, I2C, JTAG and SWD interfaces through level shifters that operate from 1.8 to 5.5 V. One of the chip's two ports is dedicated to UART and the other is shared by the remaining interfaces; switches select the reference voltage and the SPI/JTAG or I2C/SWD wiring, and a logic-analyzer header lets an external analyzer watch the traffic. Tigard has no software of its own: it is designed to work with existing x232H tools, and the README gives settings for reading SPI flash, JTAG debugging with OpenOCD or Black Magic Debug, SWD debugging with OpenOCD, boundary scan, and iCE40 or AVR programming.","description_zh":"以 FTDI FT2232H 为核心的开源硬件板卡，通过工作电压为 1.8–5.5 V 的电平转换器，把计算机连接到目标设备的 UART、SPI、I2C、JTAG 和 SWD 接口。芯片的两个端口中，一个专用于 UART，另一个由其余接口共用；拨动开关用于选择参考电压以及 SPI/JTAG 或 I2C/SWD 接线方式，逻辑分析仪排针则可让外接分析仪观察通信。Tigard 本身不带软件，而是按现有 x232H 工具的支持方式设计；README 给出了读取 SPI 闪存、用 OpenOCD 或 Black Magic Debug 进行 JTAG 调试、用 OpenOCD 进行 SWD 调试、边界扫描，以及为 iCE40 或 AVR 编程的设置方法。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware","protocol"],"verified_at":"2026-10-27"},{"id":"axmlprinter","name":"axmlprinter","name_zh":"axmlprinter Android 二进制 XML 解析器","url":"https://github.com/rednaga/axmlprinter","evidence_url":"https://github.com/rednaga/axmlprinter/blob/5a8d3e5f37780de48a29acc280c9660e400eceb1/README.md","description_en":"Java library and command-line tool that parses Android binary XML, such as the compiled AndroidManifest.xml inside an APK, and prints it as readable XML. Red Naga's near-complete rewrite of the Android4ME AXMLPrinter tolerates manipulated files seen in the wild, including out-of-order string tables and mangled start tags, and can write the classic AXML format back out. Since v2.0.0 it also reads the protobuf XML used in Android App Bundles and detects which format it was given.","description_zh":"用于解析 Android 二进制 XML（例如 APK 中编译后的 AndroidManifest.xml）并输出为可读 XML 的 Java 库和命令行工具。它是 Red Naga 对 Android4ME AXMLPrinter 几乎全部重写的版本，能够处理实际样本中被篡改的文件，包括字符串表乱序和起始标签被改写等情况，并可重新写出传统 AXML 格式。自 v2.0.0 起，它还能读取 Android App Bundle 使用的 protobuf 格式 XML，并自动识别输入格式。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"hetty","name":"Hetty","name_zh":"Hetty HTTP 安全研究工具包","url":"https://github.com/dstotijn/hetty","evidence_url":"https://github.com/dstotijn/hetty/blob/8ca6b07b75c2df85e4890b61748f9fbccbf4443c/README.md","description_en":"Open-source HTTP toolkit for security research, which its author aims to make an alternative to Burp Suite Pro. A single Go binary runs a machine-in-the-middle HTTP proxy backed by its own generated root CA, logs proxied requests and responses in per-project databases with search filters and scope rules, and serves a web admin interface. From that interface an analyst can hold requests and responses for manual review, then edit, forward or cancel them, or copy logged requests into a Sender module to edit and resend them.","description_zh":"用于安全研究的开源 HTTP 工具包，作者希望把它做成 Burp Suite Pro 的替代品。单个 Go 程序即可运行一个使用自生成根 CA 的中间人 HTTP 代理，把经过代理的请求和响应记录到按项目划分的数据库中，支持搜索过滤和范围规则，并提供 Web 管理界面。分析者可在界面中拦下请求和响应进行人工检查，再编辑、放行或取消；也可把已记录的请求复制到 Sender 模块，修改后重新发送。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-27"},{"id":"flowdroid","name":"FlowDroid","name_zh":"FlowDroid Android 静态污点分析工具","url":"https://github.com/secure-software-engineering/FlowDroid","evidence_url":"https://github.com/secure-software-engineering/FlowDroid/blob/9bf10349ec6fdceebbcfda2d261a1f23b9e2e439/README.MD","description_en":"Static data-flow (taint) analysis for Android apps and Java programs, built on Soot and usable as a command-line tool or as Maven libraries. Given an APK, the Android SDK platforms directory and a definition of sources and sinks, it models component lifecycles and callbacks to build a call graph and reports flows from sensitive sources to sinks; the bundled SourcesAndSinks.txt is a starting point for privacy leaks, and StubDroid summaries model library methods. Options cover inter-component flows from a supplied ICC model file, path reconstruction, implicit flows, reflection and timeouts that trade precision and recall for speed, and the analysis is described in the PLDI 2014 paper “FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps”.","description_zh":"面向 Android 应用和 Java 程序的静态数据流（污点）分析工具，基于 Soot 构建，可作为命令行工具使用，也可作为 Maven 库集成。输入 APK、Android SDK 的 platforms 目录以及源点和汇点定义后，它会对组件生命周期和回调建模以构建调用图，并报告从敏感源点流向汇点的数据流；随附的 SourcesAndSinks.txt 可作为分析隐私泄露的起点，StubDroid 摘要则用于对库方法建模。选项涵盖依据用户提供的 ICC 模型文件分析组件间数据流、路径重建、隐式流、反射，以及用精度和召回率换取速度的超时设置；其分析方法发表于 PLDI 2014 论文《FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps》。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"boomerang-decompiler","name":"Boomerang Decompiler","name_zh":"Boomerang 机器码反编译器","url":"https://github.com/BoomerangDecompiler/boomerang","evidence_url":"https://github.com/BoomerangDecompiler/boomerang/blob/411041305f90d1d7c994f67255b5c03ea8666e60/Readme.md","description_en":"Fork of the SourceForge Boomerang project, a general machine-code decompiler that translates executables into C. The README lists x86 (IA-32 only), PowerPC and ST20 code in ELF, PE, DOS MZ, DOS/4GW LE and Mach-O files; instruction semantics are defined in SSL specification files, and library signature files plus printf- and scanf-style format strings help recover types. It provides a boomerang-cli command-line tool and a Qt boomerang-gui application, with unit, regression and recompilation test suites.","description_zh":"SourceForge 上 Boomerang 项目的分支，是一款通用的机器码反编译器，可将可执行文件转换为 C 代码。README 列出的支持范围为 ELF、PE、DOS MZ、DOS/4GW LE 和 Mach-O 文件中的 x86（仅 IA-32）、PowerPC 和 ST20 代码；指令语义由 SSL 规格文件定义，库函数签名文件以及 printf、scanf 类格式字符串可辅助恢复类型。它提供 boomerang-cli 命令行工具和基于 Qt 的 boomerang-gui 图形界面，并附有单元、回归和重编译测试套件。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"ubi-reader","name":"UBI Reader","name_zh":"UBI Reader UBI/UBIFS 镜像读取工具","url":"https://github.com/onekey-sec/ubi_reader","evidence_url":"https://github.com/onekey-sec/ubi_reader/blob/5f45e50c813599d689b8cf88e12e7c79dec1728f/README.md","description_en":"Python module and command-line scripts that read UBI and UBIFS images, including ones inside raw NAND dumps, by locating the first UBI or UBIFS data in a file. They extract files or whole UBI and UBIFS images, list and copy single files, display UBI headers, volume tables and the UBIFS super and master nodes, and search physical erase blocks when debugging failed extractions. ubireader_utils_info also derives the mtd-utils parameters, written as a shell script and config file, needed to rebuild an image to the same specification.","description_zh":"读取 UBI 和 UBIFS 镜像的 Python 模块与命令行脚本，通过定位文件中首个 UBI 或 UBIFS 数据来处理镜像，也适用于原始 NAND 转储。它们可提取文件或完整的 UBI、UBIFS 镜像，列出并复制单个文件，显示 UBI 头部、卷表以及 UBIFS 的超级节点和主节点，并能在提取失败时按条件搜索物理擦除块进行调试。ubireader_utils_info 还能推算出 mtd-utils 参数，生成按相同规格重建镜像所需的 shell 脚本和配置文件。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"ktool","name":"ktool","name_zh":"ktool Mach-O 与 Objective-C 分析工具包","url":"https://github.com/0cyn/ktool","evidence_url":"https://github.com/0cyn/ktool/blob/faed829b838dc4060b7e36f90239a52cd37f2a45/README.md","description_en":"Pure-Python toolkit for static Mach-O and Objective-C analysis, used as the ktool command line, a terminal browser (ktool open) or a library, with no compiled dependencies. Its commands print load commands, linked libraries, symbol tables, imports and exports, Objective-C classes and protocols, Swift types, function starts and code-signing entitlements, and dump reconstructed Objective-C headers or .tbd stubs. It can also list and extract kexts from kernel caches, split and combine fat binaries, change install names and insert load commands.","description_zh":"纯 Python 编写的 Mach-O 与 Objective-C 静态分析工具包，可作为 ktool 命令行、终端浏览界面（ktool open）或程序库使用，没有需要编译的依赖。其命令可列出加载命令、链接库、符号表、导入与导出符号、Objective-C 类和协议、Swift 类型、函数起始地址以及代码签名权限（entitlements），并可导出重建的 Objective-C 头文件或 .tbd 存根。它还能列出并提取内核缓存中的 kext，拆分和合并 fat 二进制文件，修改安装名并插入加载命令。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-27"},{"id":"qtty-jadx-mcp-server","name":"JADX MCP Server (Qtty)","name_zh":"JADX MCP Server（Qtty）","url":"https://github.com/Qtty/jadx-mcp-server","evidence_url":"https://github.com/Qtty/jadx-mcp-server/blob/4e6d890d1d3753d2bb47d492a9523ef98874df85/README.md","description_en":"MCP server for Android APK analysis in which a Python FastMCP process talks to the agent over stdio and drives a long-lived local JVM daemon that embeds JADX 1.5.6 as a library, so no JADX GUI is involved and a loaded APK stays warm between sessions. Its 23 tools return classes, decompiled sources with size-capped outlines, methods, fields, smali, cross-references and callees read from a dex-derived index, type hierarchies and overrides, exported and deep-link components, the manifest and resource files, plus a whole-APK sweep for framework sink call sites grouped by impact category.","description_zh":"用于 Android APK 分析的 MCP 服务：Python FastMCP 进程通过 stdio 与智能体通信，并驱动一个常驻本地的 JVM 守护进程，后者以库的形式内嵌 JADX 1.5.6，因此无需 JADX 图形界面，已加载的 APK 也能在会话之间保持就绪。它的 23 个工具可返回类列表、超出大小上限时改为大纲的反编译源码、方法、字段、smali、基于 dex 索引的交叉引用与被调函数、类型层次与重写关系、导出组件和深层链接组件、清单与资源文件，并能在整个 APK 中按影响类别扫描框架敏感调用点。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app"],"verified_at":"2026-10-27"},{"id":"payload-dumper-go","name":"payload-dumper-go","name_zh":"payload-dumper-go Android OTA 载荷提取工具","url":"https://github.com/ssut/payload-dumper-go","evidence_url":"https://github.com/ssut/payload-dumper-go/blob/c3a50ba8d784764c06143c1f82971cd81a77f9d6/README.md","description_en":"Go command-line tool and library that extracts partition images from Android A/B OTA payloads, reading either a raw payload.bin or the OTA zip that contains it in place. It decompresses operations in parallel, can list partitions or dump only selected ones, and verifies operation data, source images and final images with SHA-256, exiting non-zero on any mismatch. Incremental (delta) payloads are applied onto previously extracted base images, and it regenerates the dm-verity hash tree and FEC parity that delta payloads omit, so the README reports bit-exact output.","description_zh":"用 Go 编写的命令行工具和库，可从 Android A/B OTA 载荷中提取分区镜像，既可读取原始 payload.bin，也可直接就地读取包含它的 OTA zip 包。它并行解压各项操作，可列出分区或只导出选定分区，并用 SHA-256 校验操作数据、源镜像和最终镜像，任何不一致都会以非零退出码结束。增量（差分）载荷会应用在先前提取的基础镜像之上，并重新生成差分载荷省略的 dm-verity 哈希树和 FEC 校验数据，因此 README 称输出可做到逐位一致。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"brida","name":"Brida","name_zh":"Brida Burp Suite 与 Frida 桥接扩展","url":"https://github.com/federicodotta/Brida","evidence_url":"https://github.com/federicodotta/Brida/blob/f3350346c10713a0bb558b9bc018a0c0e250479d/README.md","description_en":"Burp Suite extension by Federico Dotta and Piergiovanni Cipolloni that bridges Burp and Frida, so an analyst can run an app's own functions on the HTTP messages it exchanges with its backend instead of reimplementing its encryption, encoding or signing. A graphical plugin engine connects Frida-exported functions to Burp: they can process requests and responses in every Burp tool, or run from custom message-editor tabs, context-menu entries and buttons, and a Generate Stubs tool emits Java or Python code for external Burp extensions. An analysis tab shows the app's Java and Objective-C classes, methods, imports and exports as a tree, from which hooks that log arguments and return values, or replace return values, can be added; an editor holds the analyst's own Frida exports.","description_zh":"由 Federico Dotta 和 Piergiovanni Cipolloni 开发的 Burp Suite 扩展，在 Burp 与 Frida 之间架起桥梁，让分析者直接调用应用自身的函数处理它与后端交换的 HTTP 消息，而不必重新实现其中的加密、编码或签名逻辑。图形化插件引擎把 Frida 导出函数接入 Burp：既可在所有 Burp 工具中处理请求和响应，也可通过自定义消息编辑标签页、右键菜单项和按钮调用；Generate Stubs 工具还能为外部 Burp 扩展生成 Java 或 Python 代码。分析标签页以树形展示应用的 Java 和 Objective-C 类、方法以及导入导出，可从中添加挂钩，记录参数和返回值，或替换返回值；内置编辑器用于编写分析者自己的 Frida 导出函数。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-27"},{"id":"debundle","name":"debundle","name_zh":"debundle JavaScript 打包文件拆包工具","url":"https://github.com/1egoman/debundle","evidence_url":"https://github.com/1egoman/debundle/blob/67531ffe13c3a78db08b51dd37f7ba9c4f77e98c/README.md","description_en":"Node.js command-line tool that unpacks JavaScript bundles produced by Browserify or Webpack back into a tree of module files, so a bundle can be read file by file instead of as one script. A JSON configuration gives the bundle type, the entry-point module and optional knownPaths that map numeric module IDs to output files or node_modules packages, and it can rewrite a minifier's renamed require identifier inline or through a variable so the output can be rebundled or run in Node. The README says it was built to learn how bundles are structured for a reverse-engineering project and that debundling is lossy: package.json settings and Webpack module names are not recovered, and minified code stays minified.","description_zh":"Node.js 命令行工具，可把 Browserify 或 Webpack 生成的 JavaScript 打包文件还原为按模块拆分的文件树，便于逐个文件阅读，而不必面对一整个脚本。JSON 配置文件指定打包类型、入口模块，以及可选的 knownPaths（把数字模块 ID 映射为输出文件或 node_modules 中的包路径）；它还能以内联或变量方式改写被压缩工具重命名的 require 标识符，使输出可重新打包或在 Node 中运行。README 称该工具是作者为一个逆向工程项目了解打包结构而编写的，并指出拆包是有损的：无法恢复 package.json 设置和 Webpack 模块名称，压缩过的代码拆出后仍是压缩状态。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-27"},{"id":"qu1cksc0pe","name":"Qu1cksc0pe","name_zh":"Qu1cksc0pe 恶意软件分析工具","url":"https://github.com/CYB3RMX/Qu1cksc0pe","evidence_url":"https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/README.md","description_en":"All-in-one malware triage tool that statically analyses Windows PE, Linux ELF (including Go binaries), macOS Mach-O and Android APK, JAR and DEX files as well as Office and PDF documents, scripts, shortcuts, archives, e-mails and PCAPs, reporting imports and API categories, sections, strings and IOCs, packers, embedded executables, Android permission risk, YARA matches and, for Windows and Linux, MITRE ATT&CK mappings. VBA/VBScript, JavaScript and PowerShell are run through bounded in-memory emulators instead of being executed, and --watch modes monitor live Windows, Linux and Android processes. A CLI, a Flask web UI and an MCP server expose the analyses, with optional LLM summaries of the JSON reports.","description_zh":"一体化恶意软件初筛工具，可对 Windows PE、Linux ELF（含 Go 二进制）、macOS Mach-O 和 Android APK、JAR、DEX 文件，以及 Office 与 PDF 文档、脚本、快捷方式、压缩包、电子邮件和 PCAP 做静态分析，报告导入表与 API 分类、节区、字符串与 IOC、加壳器、内嵌可执行文件、Android 权限风险和 YARA 匹配，并为 Windows 与 Linux 程序给出 MITRE ATT&CK 映射。VBA/VBScript、JavaScript 和 PowerShell 交由有界的内存内模拟器处理，而不会真正执行；--watch 模式可监视 Windows、Linux 和 Android 上运行中的进程。分析功能可通过命令行、Flask 网页界面和 MCP 服务器调用，还可选择用大语言模型总结 JSON 报告。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-27"},{"id":"gr-lora","name":"gr-lora","name_zh":"gr-lora LoRa 物理层解码模块","url":"https://github.com/rpp0/gr-lora","evidence_url":"https://github.com/rpp0/gr-lora/blob/90343d45a3c73c84d32d74b8603b6c01de025b08/README.md","description_en":"GNU Radio out-of-tree module by Pieter Robyns and co-authors for receiving and decoding LoRa physical-layer frames with a software-defined radio, implementing the modulation features described in patents and blog posts. Its receiver channelizes the input, detects and synchronizes to LoRa chirps with clock-drift correction, and decodes symbols through Gray mapping, deinterleaving, dewhitening and Hamming decoding into header and payload bytes, which a message socket sink can forward over UDP port 40868. The bundled flowgraphs decode recorded traces or live captures, and the README lists HackRF One, USRP B201, RTL-SDR and LimeSDR as tested receivers.","description_zh":"由 Pieter Robyns 等人开发的 GNU Radio 树外模块，借助软件定义无线电接收并解码 LoRa 物理层帧，实现了专利和博客文章中描述的调制特性。其接收器先对输入进行信道化，检测 LoRa 线性调频信号并与之同步、校正时钟漂移，再经格雷映射、解交织、去白化和汉明译码把符号还原为报头和载荷字节；消息套接字汇点可把结果通过 UDP 端口 40868 转发。附带的流图可解码录制的信号或实时采集的信号，README 列出 HackRF One、USRP B201、RTL-SDR 和 LimeSDR 为经过测试的接收设备。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"cnnpre","name":"CNNPRE (IEEE Access 2023)","name_zh":"CNNPRE：基于 CNN 的协议逆向方法（IEEE Access 2023）","url":"https://github.com/JG91/CNNPRE","evidence_url":"https://github.com/JG91/CNNPRE/blob/c7679ee4fb20fd7c3ff712b3e1287bdbbf171421/README.md","description_en":"Research code and data for CNNPRE, a message-type identification method for protocol reverse engineering by Javad Garshasbi and Mehdi Teimouri, published in IEEE Access in 2023. A single Colab notebook turns each message's padded bit string into a resized grayscale image, extracts features with an ImageNet-pretrained ResNet50 as transfer learning, adds message direction and length-group encodings, reduces the features with UMAP and clusters messages with agglomerative clustering and HDBSCAN, scoring each clustering against labelled message types. Preprocessed message datasets for twelve protocols, from ARP and DNS to SMTP and GSM, accompany the notebook.","description_zh":"CNNPRE 的研究代码与数据。CNNPRE 是 Javad Garshasbi 与 Mehdi Teimouri 于 2023 年发表在 IEEE Access 上、用于协议逆向工程的报文类型识别方法。仓库中唯一的 Colab 笔记本把每条报文补齐后的比特串转为缩放的灰度图像，借助在 ImageNet 上预训练的 ResNet50 进行迁移学习以提取特征，加入报文方向和长度分组编码，用 UMAP 降维后再以凝聚聚类和 HDBSCAN 对报文聚类，并将各聚类结果与已标注的报文类型比较评分。笔记本附有从 ARP、DNS 到 SMTP、GSM 等十二种协议的预处理报文数据集。","kind":"research","category":"protocol-analysis","group":"learn","relationship":"learning","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"termshark","name":"termshark","name_zh":"termshark tshark 终端界面","url":"https://github.com/gcla/termshark","evidence_url":"https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/README.md","description_en":"Graham Clark's terminal user interface for tshark, inspired by Wireshark and aimed at inspecting captures on a remote machine, for example over SSH, without copying them back to a desktop. It reads pcap files, fifos or standard input, or captures live from one or more interfaces, and shows a packet list filtered with Wireshark display filters next to the dissected packet structure and a hex view. Analysis views reassemble TCP and UDP streams with search and client- or server-only display, list Ethernet, IPv4, IPv6, UDP and TCP conversations that can be turned into display filters, and search packet contents; Wireshark-style profiles can reuse a linked Wireshark profile's packet colors.","description_zh":"Graham Clark 开发的 tshark 终端界面，设计上参考 Wireshark，便于在远程机器上（例如通过 SSH）直接检查抓包文件，而不必先拷回桌面。它可读取 pcap 文件、fifo 或标准输入，也可从一个或多个网络接口实时抓包；界面在按 Wireshark 显示过滤器筛选的数据包列表旁，同时显示解析后的数据包结构和十六进制视图。分析视图可以重组 TCP 和 UDP 流，支持搜索并可只看客户端或服务端数据；还能列出 Ethernet、IPv4、IPv6、UDP 和 TCP 会话并据此生成显示过滤器，以及搜索数据包内容。类似 Wireshark 的配置方案可以关联 Wireshark 配置，沿用其中的数据包着色规则。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"mithril-iot-scanner","name":"mithril","name_zh":"mithril 物联网固件静态扫描器","url":"https://github.com/nmatt0/mithril","evidence_url":"https://github.com/nmatt0/mithril/blob/3f5bf55f9481b6447f4a8fb410862baff55b07f8/README.md","description_en":"Offline C++ scanner for the contents of firmware and IoT software, pointed at a single file or an already unpacked root filesystem, that reports embedded secrets, a software bill of materials, known CVEs, open-source licenses, boot-security configuration and weak or publicly known keys, each finding with its evidence and a confidence level. Its SBOM also recovers components from ELF version banners, libc filenames and the kernel banner in stripped images and is written as CycloneDX and SPDX, while the CVE pass joins it against a local OSV and NVD mirror annotated with CISA KEV and EPSS. It does not unpack images; the author's companion tool moria handles identification and extraction.","description_zh":"离线运行的 C++ 扫描器，用于分析固件和物联网软件的内容，可指向单个文件或已解包的根文件系统，报告其中嵌入的机密信息、软件物料清单（SBOM）、已知 CVE、开源许可证、启动安全配置，以及强度不足或私钥已公开的密钥，每项发现都附带证据和置信度。其 SBOM 还能在已剥离符号的镜像中，从 ELF 版本标识、libc 文件名和内核标识中识别组件，并输出为 CycloneDX 和 SPDX；CVE 检查则将 SBOM 与本地的 OSV 和 NVD 镜像比对，并标注 CISA KEV 与 EPSS 信息。它本身不解包镜像，识别和提取由作者的配套工具 moria 完成。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"sigdigger","name":"SigDigger","name_zh":"SigDigger 数字信号分析器","url":"https://github.com/BatchDrake/SigDigger","evidence_url":"https://github.com/BatchDrake/SigDigger/blob/70f688bb1ee7532fd45df079f753f7f92e841c08/README.md","description_en":"Qt graphical digital signal analyzer by Gonzalo José Carracedo Carballal, built on his Suscan and Sigutils libraries; its user manual names reverse engineering of radio signals with unknown parameters as the main use. It receives from SoapySDR-supported SDRs or plays back recorded I/Q and WAV files, shows spectrum and waterfall views, and lets analysts measure captured stretches in a time window with carrier recovery, transforms and symbol sampling. Inspector tabs run user-tunable PSK, FSK and ASK demodulators with parameter estimation and can forward demodulated samples; it also decodes analog video and previews AM, FM and SSB audio.","description_zh":"由 Gonzalo José Carracedo Carballal 开发的 Qt 图形化数字信号分析器，基于他编写的 Suscan 与 Sigutils 库；用户手册称其主要用途是对参数未知的无线电信号进行逆向分析。它可从 SoapySDR 支持的 SDR 设备接收信号，或回放录制的 I/Q 与 WAV 文件，提供频谱和瀑布图视图，并可在时间窗口中测量截取的片段，支持载波恢复、变换和符号采样。检查器（inspector）标签页运行可由用户调节的 PSK、FSK 和 ASK 解调器，提供参数估计，并可转发解调后的样本；它还能解码模拟视频，并预听 AM、FM 和 SSB 音频。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"appmon","name":"AppMon","name_zh":"AppMon 基于 Frida 的应用 API 监控框架","url":"https://github.com/dpnishant/appmon","evidence_url":"https://github.com/dpnishant/appmon/blob/f753c4d287cd752fe926d2087236a98c3810d3e4/README.md","description_en":"Frida-based framework by Nishant Das Patnaik, shown at Black Hat Arsenal 2016, for watching the system API calls that native macOS, iOS and Android apps make. Its Sniffer attaches to or spawns an app, loads hook scripts from a bundled library covering areas such as crypto, keychain, files, SQLite, HTTP, IPC and WebView, and records each intercepted call in a per-app SQLite database that a local Flask web interface displays. Further components trace Java classes, methods and argument types in Android apps and repackage IPAs or APKs with Frida Gadget so they can be inspected on non-jailbroken or non-rooted devices.","description_zh":"基于 Frida 的框架，由 Nishant Das Patnaik 开发，曾在 2016 年 Black Hat Arsenal 展示，用于观察 macOS、iOS 和 Android 原生应用发起的系统 API 调用。其 Sniffer 组件可附加到应用或启动应用，加载内置脚本库中的挂钩脚本（涵盖加密、钥匙串、文件、SQLite、HTTP、IPC 和 WebView 等方面），并把每次截获的调用记录到按应用划分的 SQLite 数据库中，由本地 Flask 网页界面展示。其他组件可追踪 Android 应用中的 Java 类、方法及参数类型，并可把 IPA 或 APK 与 Frida Gadget 一起重新打包，以便在未越狱或未 root 的设备上进行检查。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"img4tool","name":"img4tool","name_zh":"img4tool Apple IMG4 容器工具","url":"https://github.com/tihmstar/img4tool","evidence_url":"https://github.com/tihmstar/img4tool/blob/bb2d63494c58993f5c8ce2ed7df207ab1063587b/README.md","description_en":"tihmstar's command-line tool and C++ library for Apple's IMG4 firmware container format. It prints the ASN.1 contents of IMG4 files, IM4P payload containers and IM4M signing manifests, including payload types, descriptions and key bags, and extracts IM4P or IM4M parts from IMG4 or SHSH files and payloads from IM4P files, decompressing LZSS or BVX2 (LZFSE) data and decrypting it when given an IV and key. It can also check an IM4M ticket or a signed IMG4 against a BuildManifest, convert IM4M files to SHSH, and build or rename containers for restore tooling.","description_zh":"tihmstar 开发的命令行工具和 C++ 库，用于处理 Apple 的 IMG4 固件容器格式。它可以打印 IMG4 文件、IM4P 载荷容器和 IM4M 签名清单的 ASN.1 内容，包括载荷类型、描述和密钥包（KBAG）；也可从 IMG4 或 SHSH 文件中提取 IM4P 或 IM4M、从 IM4P 中提取载荷，自动解压 LZSS 或 BVX2（LZFSE）压缩数据，并在提供 IV 和密钥时解密。此外，它能根据 BuildManifest 校验 IM4M 票据或已签名的 IMG4，把 IM4M 转换为 SHSH，并为恢复工具构建或重命名容器。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-27"},{"id":"owl-awdl-open-implementation-case","name":"OWL: an open Apple Wireless Direct Link implementation","name_zh":"OWL：开源的 Apple 无线直连（AWDL）实现","url":"https://github.com/seemoo-lab/owl","evidence_url":"https://github.com/seemoo-lab/owl/blob/0ee3263f944ea721c355f826aa90d636d012a512/README.md","description_en":"Reimplements Apple Wireless Direct Link (AWDL), the proprietary Wi-Fi ad hoc protocol Apple devices use for peer-to-peer links such as AirDrop, as a user-space C daemon for Linux and macOS; the README calls it the result of reverse engineering by the Open Wireless Link project at TU Darmstadt's SEEMOO lab. OWL runs the master election, synchronises availability windows and the channel sequence, parses and crafts AWDL action and data frames, and provides an awdl0 virtual interface with a link-local IPv6 address, so unmodified IPv6 programs such as SEEMOO's OpenDrop AirDrop client can reach Apple devices. The authors describe the recovered protocol in a MobiCom 2018 paper.","description_zh":"以用户态 C 守护进程在 Linux 和 macOS 上重新实现 Apple 无线直连（AWDL）——Apple 设备用于 AirDrop 等点对点连接的专有 Wi-Fi 自组网协议；README 称其为达姆施塔特工业大学 SEEMOO 实验室 Open Wireless Link 项目逆向工程的成果。OWL 执行主节点选举，同步可用窗口和信道序列，解析并构造 AWDL 动作帧与数据帧，并提供带链路本地 IPv6 地址的 awdl0 虚拟网络接口，使未经修改的 IPv6 程序（如 SEEMOO 的 AirDrop 客户端 OpenDrop）能够与 Apple 设备通信。作者在 MobiCom 2018 论文中描述了还原出的协议。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-27"},{"id":"grpc-tools","name":"grpc-tools","name_zh":"grpc-tools gRPC 流量调试工具集","url":"https://github.com/bradleyjkemp/grpc-tools","evidence_url":"https://github.com/bradleyjkemp/grpc-tools/blob/928b1b952d0d1345f0ef8fd2702e2df5240068bd/README.md","description_en":"Bradley Kemp's suite of gRPC debugging tools, described as Fiddler or Charles for gRPC. grpc-dump runs as a local HTTP(S) proxy that logs every gRPC and gRPC-Web call an application makes as a JSON stream with service and method names, metadata, any error status and each message both raw and parsed; without the .proto files it decodes messages heuristically. grpc-replay re-sends the recorded requests and checks the server's responses, grpc-fixture answers clients from a saved dump, and the grpc-proxy Go library underlies them.","description_zh":"Bradley Kemp 编写的一套 gRPC 调试工具，自称相当于 gRPC 版的 Fiddler 或 Charles。grpc-dump 作为本地 HTTP(S) 代理运行，把应用发出的每次 gRPC 与 gRPC-Web 调用记录为 JSON 流，包含服务名、方法名、元数据、可能出现的错误状态，以及每条消息的原始与解析形式；没有 .proto 文件时，它会以启发式方法解码消息。grpc-replay 重新发送记录下的请求并核对服务器响应，grpc-fixture 用保存的转储应答客户端，它们都构建在 grpc-proxy Go 库之上。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-27"},{"id":"jstillery","name":"JStillery","name_zh":"JStillery JavaScript 部分求值反混淆工具","url":"https://github.com/mindedsecurity/JStillery","evidence_url":"https://github.com/mindedsecurity/JStillery/blob/512e9af2a54eb4592bf6fa6ac8483ceeb5726b03/README.md","description_en":"Minded Security's JavaScript deobfuscator, which Stefano Di Paola forked from esdeobfuscate in 2015, simplifies scripts by partial evaluation on an esprima AST. It folds constant and string expressions, propagates known values through variables and pure function calls, evaluates calls to built-in String, Array and Number methods and atob/btoa, and parses string arguments passed to eval back into code. It runs as a command-line tool on a file or stdin, as an Express server with a web UI and a REST endpoint, or as a browserified library.","description_zh":"Minded Security 的 JavaScript 反混淆工具，由 Stefano Di Paola 于 2015 年从 esdeobfuscate 分支而来，在 esprima 语法树上通过部分求值简化脚本。它会折叠常量和字符串表达式，经由变量和纯函数调用传播已知值，对内置 String、Array、Number 方法以及 atob/btoa 的调用求值，并把传给 eval 的字符串参数重新解析为代码。它可作为命令行工具处理文件或标准输入，也可作为带网页界面和 REST 接口的 Express 服务运行，或作为经 browserify 打包的库使用。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-27"},{"id":"enjarify","name":"Enjarify","name_zh":"Enjarify Dalvik 转 Java 字节码工具","url":"https://github.com/google/enjarify","evidence_url":"https://github.com/google/enjarify/blob/f2db0563aa83885ce6e6acd5b7dc9a8a1a1e1987/README.md","description_en":"Pure-Python 3 translator from Dalvik bytecode to equivalent Java bytecode, so Java analysis tools and decompilers can be applied to Android apps: given an APK, with every DEX file of a multidex APK combined into one jar, or a single DEX file, it writes a jar of class files. Its README contrasts it with dex2jar and lists edge cases it handles, such as Unicode class names, constants used as several types, implicit casts, exception handlers that jump into normal control flow, very long methods and classes that reference too many constants. By default it also applies readability optimizations such as copy propagation and unused-value removal.","description_zh":"用纯 Python 3 编写的转换工具，把 Dalvik 字节码转换为等价的 Java 字节码，使 Java 分析工具和反编译器可以用于 Android 应用：输入 APK（多 dex APK 中的所有 DEX 文件会合并到同一个 jar）或单个 DEX 文件，即可输出由 class 文件组成的 jar。README 将其与 dex2jar 对比，并列出它能处理的边缘情况，例如 Unicode 类名、被当作多种类型使用的常量、隐式类型转换、跳入正常控制流的异常处理器、超长方法，以及引用常量过多的类。默认还会进行复制传播、删除未使用值等提高可读性的优化。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-27"},{"id":"yagi-ghidra-decompiler-for-ida","name":"Yagi","name_zh":"Yagi：IDA 中的 Ghidra 反编译器","url":"https://github.com/airbus-cert/Yagi","evidence_url":"https://github.com/airbus-cert/Yagi/blob/6fc4787bf3dcb8480be5bf990662b30bf9130d53/README.md","description_en":"Airbus CERT plugin that embeds Ghidra's native decompiler in IDA Pro and IDA Free: pressing F3 on a function shows Ghidra's C output inside IDA, and edits made there, covering global symbols such as function prototypes and the names and types of stack and register variables, are saved to the IDA database. The README lists x86, x86-64, ARM, AArch64, PowerPC, MIPS, SPARC, AVR8, 6502, Z80 and eBPF as supported, while other Ghidra processors such as Dalvik, JVM, RISC-V and 68000 are not yet enabled.","description_zh":"Airbus CERT 开发的插件，把 Ghidra 的原生反编译器嵌入 IDA Pro 和 IDA Free：在函数上按 F3 即可在 IDA 中查看 Ghidra 生成的 C 代码，在其中所做的修改（包括函数原型等全局符号，以及栈变量和寄存器变量的名称与类型）会保存到 IDA 数据库。README 列出已支持 x86、x86-64、ARM、AArch64、PowerPC、MIPS、SPARC、AVR8、6502、Z80 和 eBPF，而 Dalvik、JVM、RISC-V、68000 等其他 Ghidra 处理器尚未启用。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-27"},{"id":"box-js","name":"box.js","name_zh":"box.js 恶意 JavaScript 分析工具","url":"https://github.com/CapacitorSet/box-js","evidence_url":"https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/README.md","description_en":"Node.js utility for studying malicious JavaScript that runs a sample inside an emulated Windows JScript environment, with WScript, ActiveX, filesystem, registry, WMI and HTTP objects emulated and source rewriting that exposes eval calls and conditional-compilation code. Each analysis writes a results folder with the URLs requested and those that led to an executable payload, every code snippet executed (JavaScript, cmd.exe and PowerShell), files written with their types and hashes, and a list of IOCs; by default downloads are answered with simulated 404 errors so that fallback sites are revealed. Batch runs, an optional prepended file of browser-object stubs, a Docker image, a REST API and export to VirusTotal or Cuckoo support triage at scale.","description_zh":"用于研究恶意 JavaScript 的 Node.js 工具：在模拟的 Windows JScript 环境中运行样本，模拟 WScript、ActiveX、文件系统、注册表、WMI 和 HTTP 对象，并通过改写源码暴露 eval 调用和条件编译代码。每次分析都会生成结果文件夹，记录请求过的 URL 及其中导致可执行载荷的 URL、执行过的每段代码（JavaScript、cmd.exe 和 PowerShell 命令）、写入的文件及其类型和哈希，以及 IOC 列表；默认情况下，下载请求会收到模拟的 404 错误，以暴露样本的备用站点。支持批量分析、可选预置的浏览器对象桩代码文件、Docker 镜像、REST API，以及导出到 VirusTotal 或 Cuckoo，便于大规模初筛。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-27"},{"id":"usb-rea","name":"usb-rea","name_zh":"usb-rea：USB 设备协议推断命令行工具与 MCP 服务器","url":"https://github.com/emirmrkaljevic/usb-rea","evidence_url":"https://github.com/emirmrkaljevic/usb-rea/blob/3b77ccbe3b2c87e344a507937ac3c4a1b2a35eb1/README.md","description_en":"Python CLI and stdio MCP server for inferring the USB protocol of a device whose only control software is a vendor app. While the user clicks through the app, it captures traffic with usbmon or USBPcap, takes a label for each action, diffs the packets per action and infers message layouts: constant bytes, rolling counters, scaled 8- to 32-bit values, lookup tables, packed bit fields and sum, XOR or CRC checksums. It also decodes device replies, handshakes with session tokens and image streams sent to device screens, links each inferred field to Wireshark frame numbers in a report, and generates a pyusb driver and a Wireshark Lua dissector.","description_zh":"Python 命令行工具与 stdio MCP 服务器，用于推断只配有厂商应用的 USB 设备所用的协议。使用者在厂商应用中逐项操作时，它通过 usbmon 或 USBPcap 抓取流量，为每次操作记录标签，按操作比对数据包并推断消息格式：固定字节、滚动计数器、带缩放的 8 至 32 位数值、查找表、打包位字段，以及求和、异或或 CRC 校验。它还能解码设备回复、带会话令牌的握手和发往设备屏幕的图像流，在报告中把每个推断出的字段关联到 Wireshark 帧号，并生成 pyusb 驱动和 Wireshark Lua 解析器。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["protocol"],"verified_at":"2026-11-02"},{"id":"magisk-frida","name":"MagiskFrida","name_zh":"MagiskFrida 开机自启 frida-server 的 root 模块","url":"https://github.com/ViRb3/magisk-frida","evidence_url":"https://github.com/ViRb3/magisk-frida/blob/1f4003ac218cbd43b082673cd4243bba04ada019/README.md","description_en":"Magisk, KernelSU and APatch module that installs frida-server on a rooted Android device and starts it at boot, so Frida clients can attach for dynamic instrumentation without starting the server by hand. A daily GitHub Actions job checks for a new Frida release, downloads Frida's official frida-server builds for arm64, arm, x86 and x86_64, and publishes a matching module ZIP with an updater.json for updates from the root manager. The server listens on 127.0.0.1:27042 unless another port is written to a file in the module directory, and the module's action button starts or stops it.","description_zh":"Magisk、KernelSU 与 APatch 模块，在已 root 的 Android 设备上安装 frida-server 并在开机时启动，Frida 客户端无需手动启动服务即可连接进行动态插桩。GitHub Actions 每天检查 Frida 是否有新版本，下载 Frida 官方为 arm64、arm、x86 和 x86_64 构建的 frida-server，并发布对应的模块 ZIP 及供 root 管理器更新使用的 updater.json。服务默认监听 127.0.0.1:27042，可在模块目录的文件中写入其他端口；模块的操作按钮可启动或停止服务。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-02"},{"id":"raptor-frida-scripts","name":"frida-scripts (0xdea)","name_zh":"frida-scripts（0xdea）Frida 移动应用与 Linux 追踪脚本集","url":"https://github.com/0xdea/frida-scripts","evidence_url":"https://github.com/0xdea/frida-scripts/blob/987ba480812033bbe3a9d2262a9764e1a4ed8547/README.md","description_en":"Marco Ivaldi's (raptor) collection of Frida JavaScript instrumentation scripts for reverse engineering mobile apps and Linux programs. The main Android and iOS tracers hook Java or Objective-C classes and methods selected by name, wildcard or regular expression, plus native functions matched by Frida ApiResolver patterns such as exports:*!open*, and log each call's arguments and return value; they can also print backtraces. Companion scripts enumerate loaded classes and methods, and a Linux pair traces and enumerates functions in an ELF binary and its shared libraries.","description_zh":"Marco Ivaldi（raptor）编写的 Frida JavaScript 插桩脚本集，用于逆向移动应用和 Linux 程序。主力 Android 与 iOS 追踪脚本按名称、通配符或正则表达式挂钩 Java 或 Objective-C 的类与方法，并通过 exports:*!open* 等 Frida ApiResolver 模式匹配原生函数，记录每次调用的参数与返回值，并可输出调用栈。配套脚本可枚举已加载的类与方法；另有一对 Linux 脚本用于追踪并枚举 ELF 二进制文件及其共享库中的函数。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-11-02"},{"id":"zygisk-il2cppdumper","name":"Zygisk-Il2CppDumper","name_zh":"Zygisk-Il2CppDumper 运行时导出 IL2CPP 元数据的 Zygisk 模块","url":"https://github.com/Perfare/Zygisk-Il2CppDumper","evidence_url":"https://github.com/Perfare/Zygisk-Il2CppDumper/blob/ede65d18a795882e37a2d988943d77a72d132c5d/README.md","description_en":"Zygisk module by Perfare, the Il2CppDumper author, that dumps type metadata from inside a Unity IL2CPP Android app while it runs. Built for one package name, it waits for the app to load libil2cpp.so, resolves the runtime's il2cpp API exports, walks the classes of every loaded assembly and writes dump.cs to the app's files directory, listing namespaces, classes, interfaces and enums with field offsets, properties and method signatures annotated with RVA and virtual addresses. On x86 devices running an ARM build of the app, it loads its ARM library through the Houdini native bridge.","description_zh":"由 Il2CppDumper 作者 Perfare 编写的 Zygisk 模块，在 Unity IL2CPP Android 应用运行时从进程内部导出类型元数据。模块针对单个包名构建，等待应用加载 libil2cpp.so 后解析运行时导出的 il2cpp API，遍历每个已加载程序集中的类，并把 dump.cs 写入应用的 files 目录，其中列出命名空间、类、接口和枚举，以及带偏移量的字段、属性和标注 RVA 与虚拟地址的方法签名。对于在 x86 设备上运行的 ARM 版应用，它会通过 Houdini 原生桥加载自己的 ARM 库。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["app","game"],"verified_at":"2026-11-02"},{"id":"system-informer","name":"System Informer","name_zh":"System Informer 进程与系统检查工具","url":"https://github.com/winsiderss/systeminformer","evidence_url":"https://github.com/winsiderss/systeminformer/blob/999fe5ef6a554f55d8e7df43903eb31ca530377e/README.md","description_en":"Windows process viewer and system inspector, formerly Process Hacker, for examining running programs and the system around them. It gives a highlighted overview of system activity, searches the handles and loaded DLLs of processes to find which one is using a file, shows active network connections and real-time disk access, displays stack traces with kernel-mode, WOW64 and .NET support, and creates, edits and controls services. Version 4.0 adds a Process Monitor that logs process, thread, image, registry, file, handle and silo events from its kernel driver, and plugins add .NET assembly and performance tabs, a window explorer and Hybrid Analysis lookups.","description_zh":"Windows 进程查看与系统检查工具，前身为 Process Hacker，用于检查运行中的程序及其所在的系统环境。它以高亮方式概览系统活动，可在各进程的句柄和已加载 DLL 中搜索，找出正在占用某个文件的进程，显示活动网络连接和实时磁盘访问，查看支持内核模式、WOW64 和 .NET 的详细调用栈，并能创建、编辑和控制服务。4.0 版新增 Process Monitor，借助内核驱动实时记录进程、线程、映像、注册表、文件、句柄和 silo 事件；插件还提供 .NET 程序集与性能页、窗口浏览器和 Hybrid Analysis 在线查询。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"cyberchef","name":"CyberChef","name_zh":"CyberChef 数据解码与分析工具","url":"https://github.com/gchq/CyberChef","evidence_url":"https://github.com/gchq/CyberChef/blob/d4d96c6c3d2597fef836d81bfc04617d97c681a5/README.md","description_en":"GCHQ's browser-based workbench for decoding, decrypting, decompressing, parsing and carving data by chaining operations into a recipe, with all processing done client-side. The pinned operation catalogue lists 506 operations, among them XOR brute force, AES, DES and Blowfish decryption, x86 and ARM disassembly, ELF info, file-type detection, file extraction, entropy and strings, YARA rules, Protobuf decoding and Ethernet, IPv4, TCP and UDP header parsing. The Magic operation tries to detect nested encodings automatically, and breakpoints step through a recipe one operation at a time to show the data at each stage.","description_zh":"GCHQ 开发的浏览器端数据处理工具，把多个操作串成“配方”（recipe），对数据进行解码、解密、解压、解析和提取，所有处理都在本地浏览器中完成。所固定版本的操作目录列出 506 个操作，包括 XOR 暴力破解、AES/DES/Blowfish 解密、x86 与 ARM 反汇编、ELF 信息解析、文件类型识别、文件提取、熵与字符串分析、YARA 规则匹配、Protobuf 解码，以及以太网帧和 IPv4、TCP、UDP 报头解析。Magic 操作会尝试自动识别多层嵌套编码；在配方中设置断点后，可逐个操作执行，查看数据在每一步的变化。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","protocol"],"verified_at":"2026-11-05"},{"id":"yara","name":"YARA","name_zh":"YARA 文件模式匹配与分类工具","url":"https://github.com/VirusTotal/yara","evidence_url":"https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/README.md","description_en":"VirusTotal's pattern-matching tool for identifying and classifying files such as malware samples with rules that combine text, hex and regular-expression strings with a Boolean condition. It scans a file, a folder or a running process from the command line, through the libyara C API or from Python with yara-python. Modules expose parsed structure to rules: pe and elf expose most fields of PE and ELF headers, dotnet adds .NET metadata, math adds calculations such as entropy, and the optional magic and cuckoo modules add libmagic file types and Cuckoo sandbox behavior reports.","description_zh":"VirusTotal 推出的模式匹配工具，用规则识别和归类恶意软件样本等文件；每条规则由文本、十六进制和正则表达式字符串加一个布尔条件组成。可通过命令行、libyara C API 或 Python 扩展 yara-python 扫描单个文件、文件夹或运行中的进程。各模块向规则提供解析后的结构信息：pe 和 elf 模块提供 PE 与 ELF 头部的大部分字段，dotnet 模块提供 .NET 元数据，math 模块提供熵等计算，可选的 magic 和 cuckoo 模块则提供 libmagic 文件类型和 Cuckoo 沙箱行为报告数据。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"cheat-engine","name":"Cheat Engine","name_zh":"Cheat Engine 游戏与应用内存分析调试工具","url":"https://github.com/cheat-engine/cheat-engine","evidence_url":"https://github.com/cheat-engine/cheat-engine/blob/ec45d5f47f92a239ba0bf51ec5d04a7509c3fd37/README.md","description_en":"Memory scanner, debugger, disassembler and assembler for inspecting and changing running games and other applications; its README calls it a development environment focused on modding games and applications for personal use. The project site lists a memory scanner for finding the variables a game uses, a debugger, disassembler, assembler, speedhack, trainer maker, Direct3D manipulation and system inspection tools, and the README's build notes add Mono, .NET and Java runtime inspection, a VEH debugger interface, Lua and C code in scripts and an optional kernel-mode driver.","description_zh":"集内存扫描、调试、反汇编和汇编于一体的工具，用于检查和修改运行中的游戏及其他应用；README 称其为专注于游戏和应用改造（仅供个人使用）的开发环境。项目网站列出的功能包括：快速扫描游戏所用变量的内存扫描器，以及调试器、反汇编器、汇编器、变速（speedhack）、修改器（trainer）制作、Direct3D 操控和系统检查工具；README 中的构建说明还提到 Mono、.NET 和 Java 运行时检查、VEH 调试器接口、在脚本中嵌入 Lua 与 C 代码，以及可选的内核模式驱动。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-11-05"},{"id":"noriben","name":"Noriben","name_zh":"Noriben 基于 Procmon 的恶意软件行为分析脚本","url":"https://github.com/Rurik/Noriben","evidence_url":"https://github.com/Rurik/Noriben/blob/4c84a98601fd7a9559c8b225b5968159efb7dcc0/README.md","description_en":"Python script that drives Sysinternals Process Monitor to record what a program does while it runs, filters out routine system activity and writes a text report of the processes it created and its file, registry and network activity. It works as a lightweight malware sandbox and can also log events while the analyst runs a sample by hand, with command-line options, user interaction or under a debugger; created files can be scanned with YARA rules and their hashes looked up on VirusTotal. Version 2.1.0 adds DLL-load monitoring, an ASCII process tree and JSON output, and NoribenSandbox.py automates runs inside a guest VM.","description_zh":"调用 Sysinternals Process Monitor 记录程序运行时行为的 Python 脚本，会滤除常规系统活动，并生成文本报告，列出程序创建的进程及其文件、注册表和网络活动。它可以当作轻量级恶意软件沙箱使用，也能在分析人员手动运行样本时记录事件，例如样本需要特定命令行参数、需要用户交互，或在调试器中单步执行时。新建的文件可用 YARA 规则扫描，其哈希值可在 VirusTotal 上查询。2.1.0 版新增 DLL 加载监控、ASCII 进程树和 JSON 输出；NoribenSandbox.py 可在客户机虚拟机中自动完成分析流程。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"qemu","name":"QEMU","name_zh":"QEMU 机器与用户态模拟器","url":"https://www.qemu.org/","evidence_url":"https://gitlab.com/qemu-project/qemu/-/blob/f71afb409a87c4ecd0f9d63a5963eb645dfab780/README.rst","description_en":"Machine and user-space emulator that runs code built for one CPU architecture on another through its TCG dynamic translator. System emulation boots a complete emulated machine, such as an ARMv7 board on an x86_64 PC, and user-mode emulation runs Linux or BSD binaries built for another ABI by translating their system calls. For analysis, its gdbstub lets GDB stop the guest, examine registers and memory and set breakpoints and watchpoints, TCG plugins passively instrument execution down to single instructions and memory accesses (bundled examples count instructions, trace system calls and log execution), and system emulation supports deterministic record/replay debugging.","description_zh":"机器级与用户态模拟器，借助 TCG 动态翻译，在一种 CPU 架构上运行为另一种架构编译的代码。系统模拟可完整模拟一台机器，例如在 x86_64 PC 上运行 ARMv7 开发板；用户态模拟则通过转换系统调用，直接运行为其他 ABI 编译的 Linux 或 BSD 程序。在分析方面，gdbstub 允许用 GDB 暂停客户机、查看寄存器和内存、设置断点与观察点；TCG 插件能以被动方式插桩，粒度可细到单条指令和每次内存访问（自带示例可统计指令数、跟踪系统调用和记录执行过程）；系统模拟还支持确定性执行，便于录制/回放调试。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-11-05"},{"id":"hex-fiend","name":"Hex Fiend","name_zh":"Hex Fiend macOS 十六进制编辑器","url":"https://github.com/HexFiend/HexFiend","evidence_url":"https://github.com/HexFiend/HexFiend/blob/32cb2ef78d2ff3bc6ecf326a6b19eeebb2945c13/README.md","description_en":"Open-source macOS hex editor that inspects and edits binary files of any size without loading them into memory. It supports insertions and deletions, fast search and a data inspector that reads integers and floating-point values as signed or unsigned and big- or little-endian. File > Compare shows the differences between two files while accounting for inserted or deleted bytes, and Tcl binary templates display a file's structure next to its bytes; bundled templates cover COFF, ELF, Mach-O and MS-DOS EXE headers, 6502 disassembly and Commodore 64 PRG files, plus archives, file systems, partition tables and media formats. Its hex and data views are also available as an embeddable framework.","description_zh":"开源的 macOS 十六进制编辑器，无需把文件载入内存即可查看和编辑任意大小的二进制文件。它支持插入与删除字节和快速搜索，数据检查器可按有符号或无符号、大端或小端解读整数和浮点数。通过 File > Compare 可比较两个文件，并考虑插入或删除字节带来的偏移；用 Tcl 编写的二进制模板会在字节旁显示文件结构，自带模板涵盖 COFF、ELF、Mach-O 和 MS-DOS EXE 文件头、6502 反汇编、Commodore 64 PRG 文件，以及压缩包、文件系统、分区表和媒体格式。其十六进制视图和数据视图还以可嵌入框架的形式提供。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"scyllahide","name":"ScyllaHide","name_zh":"ScyllaHide 用户态反反调试库","url":"https://github.com/x64dbg/ScyllaHide","evidence_url":"https://github.com/x64dbg/ScyllaHide/blob/baa5c8e853ace2bee752631f27fdfe5b271d92f6/README.md","description_en":"User-mode (ring 3) anti-anti-debug library for 32- and 64-bit Windows programs that hooks system functions so the program being debugged cannot detect the debugger. Its documentation covers options for PEB debug flags such as BeingDebugged, NtGlobalFlag and heap flags, threads hidden with ThreadHideFromDebugger, debugger windows and processes found through window and process-list queries, invalid-handle NtClose checks, input blocking, timing checks, hardware-breakpoint detection and exception-based checks; extra options inject DLLs, prevent thread creation and dump processes started RunPE-style. Plugins integrate it with x64dbg, OllyDbg v1 and v2, IDA and TitanEngine, and the standalone InjectorCLI injects its hook library into a process under any debugger.","description_zh":"面向 32 位和 64 位 Windows 程序的用户态（ring 3）反反调试库，通过挂钩系统函数，让被调试程序察觉不到调试器。其文档逐项说明各个选项：处理 BeingDebugged、NtGlobalFlag 和堆标志等 PEB 调试标志，应对借助 ThreadHideFromDebugger 隐藏的线程，在窗口查询和进程列表中隐藏调试器的窗口与进程，应对以无效句柄调用 NtClose 的检测，以及输入屏蔽、计时检测、硬件断点检测和基于异常的检测；附加选项可注入 DLL、阻止创建线程，并转储以 RunPE 方式启动的进程。它以插件形式集成到 x64dbg、OllyDbg v1/v2、IDA 和 TitanEngine，也可用独立的 InjectorCLI 把钩子库注入到任意调试器下的进程。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"yara-x","name":"YARA-X","name_zh":"YARA-X Rust 版 YARA 模式匹配工具","url":"https://github.com/VirusTotal/yara-x","evidence_url":"https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/README.md","description_en":"VirusTotal's Rust rewrite of YARA for identifying and classifying files with pattern-matching rules. It is meant to replace YARA, with more detailed error reports, faster regular-expression and hex-pattern matching and a more capable command line. Rules keep YARA's syntax of text, hex and regular-expression patterns joined by a Boolean condition, and modules parse PE, ELF, Mach-O, .NET, Android DEX, Chrome CRX and Windows LNK files; the CLI can also print a module's parsed output as JSON or YAML without any rule, which makes it usable as a file-dissection tool. Rust, C, Go and Python APIs, a rule formatter and a language server with a Visual Studio Code extension are included.","description_zh":"VirusTotal 用 Rust 重写的 YARA，以模式匹配规则识别和归类文件。它的目标是取代 YARA，提供更详细的错误报告、更快的正则表达式与十六进制模式匹配，以及功能更强的命令行。规则沿用 YARA 的语法，即文本、十六进制和正则表达式模式加布尔条件；各模块可解析 PE、ELF、Mach-O、.NET、Android DEX、Chrome CRX 和 Windows LNK 文件。命令行无需任何规则即可把模块的解析结果输出为 JSON 或 YAML，因此也能当作文件结构剖析工具使用。项目提供 Rust、C、Go 和 Python API、规则格式化工具，以及带 Visual Studio Code 扩展的语言服务器。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"de4dot","name":"de4dot","name_zh":"de4dot .NET 反混淆与脱壳工具","url":"https://github.com/de4dot/de4dot","evidence_url":"https://github.com/de4dot/de4dot/blob/b7d5728fc0c82fb0ad758e3a4c0fbb70368a4853/README.md","description_en":"Open-source .NET deobfuscator and unpacker that tries to restore a packed and obfuscated assembly to almost its original form. Depending on the obfuscator, it decrypts strings, constants, methods, resources and embedded assemblies statically or dynamically, removes proxy methods, junk classes and tamper-detection and anti-debug code, devirtualizes virtualized code, deobfuscates control flow and renames symbols to readable names; it can also just detect which obfuscator was used. The README lists 19 supported obfuscators and packers, among them Dotfuscator, .NET Reactor, Eazfuscator.NET and SmartAssembly.","description_zh":"开源的 .NET 反混淆与脱壳工具，尝试把加壳、混淆过的程序集恢复到接近原始的状态。视混淆器而定，它能以静态或动态方式解密字符串、常量、方法、资源和内嵌程序集，移除代理方法、垃圾类以及防篡改和反调试代码，还原被虚拟化的代码和被打乱的控制流，并把符号重命名为可读名称；也可以只检测程序集使用了哪种混淆器。README 列出 19 种受支持的混淆器和加壳工具，包括 Dotfuscator、.NET Reactor、Eazfuscator.NET 和 SmartAssembly。","kind":"tool","category":"dotnet","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-05"},{"id":"reclass-net","name":"ReClass.NET","name_zh":"ReClass.NET 进程内存结构重建工具","url":"https://github.com/ReClassNET/ReClass.NET","evidence_url":"https://github.com/ReClassNET/ReClass.NET/blob/a02fcb9bd669c8f81facd3ee9ad57cdcbf2cc0e1/README.md","description_en":"Memory structure editor for reconstructing the classes and data structures of a running x86 or x64 process, a .NET port of ReClass with many additions. Users lay out memory as typed nodes, such as integers, floats, vectors and matrices, text, pointers, arrays, unions, virtual tables and function pointers, with automatic node dissection, highlighting of changed memory, types from PDB debug symbols and RTTI class names, then generate C++ or C# code from the result. It also offers a memory viewer and scanner, a module and section dumper, a debugger that finds what writes to or accesses an address, and plugins that can supply other memory-access methods or game-specific class information, such as for Frostbite games.","description_zh":"用于重建运行中 x86 或 x64 进程内类与数据结构的内存结构编辑器，是 ReClass 移植到 .NET 平台并大量扩展后的版本。使用者把内存布局成带类型的节点，如整数、浮点数、向量与矩阵、文本、指针、数组、联合体、虚函数表和函数指针，可自动剖析节点、高亮变化的内存、读取 PDB 调试符号中的类型和 RTTI 类名，再根据结果生成 C++ 或 C# 代码。它还提供内存查看器和扫描器、模块与节区转储、可找出哪些代码写入或访问某个地址的调试器，以及能提供其他内存访问方式或游戏专用类信息（例如 Frostbite 游戏）的插件。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-11-05"},{"id":"classyshark","name":"ClassyShark","name_zh":"ClassyShark Android 二进制浏览工具","url":"https://github.com/google/android-classyshark","evidence_url":"https://github.com/google/android-classyshark/blob/78ddba71b0d869cc6283f8cdbb2061b6e57a3781/README.md","description_en":"Google's standalone browser for Android executables and libraries that shows class interfaces and members, dex counts and dependencies. It opens .dex, .aar and .so libraries, .apk, .jar and .class executables and Android binary XML files such as AndroidManifest, resources and layouts, and it can export what it shows as text.","description_zh":"Google 推出的独立 Android 可执行文件与库浏览工具，可显示类接口与成员、dex 计数和依赖关系。它能打开 .dex、.aar 和 .so 库，.apk、.jar 和 .class 可执行文件，以及 AndroidManifest、资源和布局等 Android 二进制 XML 文件，并可把显示的内容导出为文本。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-05"},{"id":"rpisec-malware-analysis-course","name":"RPISEC Malware Analysis course (CSCI 4976)","name_zh":"RPISEC 恶意软件分析课程（CSCI 4976）","url":"https://github.com/RPISEC/Malware","evidence_url":"https://github.com/RPISEC/Malware/blob/bbd48df47d709a702b9345e5d38cee16af3b37bd/README.md","description_en":"Materials from the student-run Malware Analysis course that RPISEC taught at Rensselaer Polytechnic Institute in Fall 2015, built around the book Practical Malware Analysis. Twelve lectures run from basic static and dynamic analysis, x86 and IDA through Windows internals, malware behavior, data encoding, covert launching, anti-disassembly, anti-VM and anti-debugging, and packing and unpacking to the Windows kernel and rootkit techniques, with ten labs and four projects that include runtime process manipulation, unpacking automation and an APT sample analysis.","description_zh":"RPISEC 学生团队 2015 年秋季在伦斯勒理工学院（Rensselaer Polytechnic Institute）开设的恶意软件分析课程资料，课程以《Practical Malware Analysis》一书为主线。12 讲内容从基础静态与动态分析、x86 与 IDA 讲起，经过 Windows 内部机制、恶意软件行为、数据编码、隐蔽启动、反反汇编、反虚拟机与反调试、加壳与脱壳，一直讲到 Windows 内核和 rootkit 技术；另有 10 个实验和 4 个项目，涉及运行时进程操控、自动化脱壳和 APT 样本分析。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-11-05"},{"id":"corkami-pics","name":"Corkami pics","name_zh":"Corkami 文件格式图解海报集","url":"https://github.com/corkami/pics","evidence_url":"https://github.com/corkami/pics/blob/669facbb0b6a977f959ae6473b8346e98cf23f53/README.md","description_en":"Collection of posters and diagrams that dissect file formats byte by byte, published as PNG and PDF images. The binary posters cover executables (ELF, DOS COM and EXE, NE, LE, PE, Mach-O and fat Mach-O, Java class, Dalvik DEX, Python bytecode, SWF, GameCube/Wii DOL and Switch NRO) along with image, video, archive, document, sound and serialization formats, x86 and x64 opcode charts and Dalvik, JVM and .NET opcode tables. The more detailed 101 series explains PE, ELF, Mach-O, ZIP, Java class, PDF, COM and WAV files and includes Inkscape sources and proof-of-concept files.","description_zh":"逐字节剖析各类文件格式的海报与图解合集，以 PNG 和 PDF 图片发布。二进制海报涵盖可执行文件（ELF、DOS COM 与 EXE、NE、LE、PE、Mach-O 及 fat Mach-O、Java class、Dalvik DEX、Python 字节码、SWF、GameCube/Wii DOL 和 Switch NRO），以及图像、视频、压缩包、文档、音频和序列化格式，另有 x86 与 x64 操作码图表和 Dalvik、JVM、.NET 操作码表。讲解更详细的 101 系列介绍 PE、ELF、Mach-O、ZIP、Java class、PDF、COM 和 WAV 文件，并附 Inkscape 源文件和概念验证文件。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-11-05"},{"id":"keypatch","name":"Keypatch","name_zh":"Keypatch IDA Pro 汇编修补插件","url":"https://github.com/keystone-engine/keypatch","evidence_url":"https://github.com/keystone-engine/keypatch/blob/e7ecb93a4d242e83b9356b8258108773464646d4/README.md","description_en":"IDA Pro plugin built on the Keystone assembler engine that patches a binary from typed assembly, fills an address range with instructions or raw bytes and searches the loaded binary for assembly instructions. It assembles Arm, Arm64, Hexagon, MIPS, PowerPC, SPARC, SystemZ and 16-, 32- and 64-bit x86 code, shows the encoding while you type, can pad with NOPs up to the next instruction boundary, keeps the original instruction in an IDA comment and can undo the last patch.","description_zh":"基于 Keystone 汇编引擎的 IDA Pro 插件：可直接输入汇编指令修补二进制文件，用指令或原始字节填充一段地址范围，并在已加载的二进制文件中搜索汇编指令。它支持 Arm、Arm64、Hexagon、MIPS、PowerPC、SPARC、SystemZ 以及 16/32/64 位 x86，输入时即时显示编码，可用 NOP 填充到下一条指令边界，在 IDA 注释中保留原指令，并可撤销上一次修补。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"edb-debugger","name":"edb-debugger","name_zh":"edb-debugger 图形化调试器","url":"https://github.com/eteran/edb-debugger","evidence_url":"https://github.com/eteran/edb-debugger/blob/b8640ebd2f7f32839f6cbb53c7faf4374c329acd/README.md","description_en":"Qt-based graphical debugger for AArch32, x86 and x86-64 programs, inspired by OllyDbg, with Linux as its only officially supported platform. Its interface docks disassembly, register, stack and data views, adds a memory-regions window, process attaching, symbols, an expression syntax and an analysis bar similar to IDA Pro's, and its default plugins include Analyzer, Assembler, BinarySearcher, BreakpointManager, FunctionFinder, HardwareBreakpoints, HeapAnalyzer, OpcodeSearcher, ROPTool and SymbolViewer.","description_zh":"基于 Qt 的图形化调试器，受 OllyDbg 启发，支持 AArch32、x86 和 x86-64 程序，目前只正式支持 Linux。界面可停靠反汇编、寄存器、栈和数据视图，并提供内存区域窗口、附加到进程、符号支持、表达式语法，以及类似 IDA Pro 的分析条；默认插件包括 Analyzer、Assembler、BinarySearcher、BreakpointManager、FunctionFinder、HardwareBreakpoints、HeapAnalyzer、OpcodeSearcher、ROPTool 和 SymbolViewer。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"binnavi","name":"BinNavi","name_zh":"BinNavi 二进制分析 IDE","url":"https://github.com/google/binnavi","evidence_url":"https://github.com/google/binnavi/blob/4cfdd91cdda2a6150f537df91a8c4221ae50bb6d/README.md","description_en":"Google's open-sourced binary analysis IDE for inspecting, navigating, editing and annotating the control-flow graphs and call graphs of disassembled code. It also collects and combines execution traces and keeps track of analysis results among a group of analysts. Disassemblies come from IDA Pro through a bundled export plugin that writes the PostgreSQL database BinNavi uses for disassemblies, comments and traces; the README notes that no exporter exists yet for other disassemblers.","description_zh":"Google 开源的二进制分析 IDE，可查看、浏览、编辑和注释反汇编代码的控制流图与调用图。它还能收集并合并执行跟踪，帮助分析团队共同跟踪分析结果。反汇编数据由随附的 IDA Pro 导出插件写入 PostgreSQL 数据库，BinNavi 用该数据库存储反汇编、注释和跟踪记录；README 指出目前还没有面向其他反汇编器的导出工具。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"flare-emu","name":"flare-emu","name_zh":"flare-emu 二进制分析框架模拟执行库","url":"https://github.com/mandiant/flare-emu","evidence_url":"https://github.com/mandiant/flare-emu/blob/6688c3270d9847c1b96ffcae00f58c0c85ab1a7e/README.md","description_en":"Mandiant FLARE Python library that pairs IDA Pro, Rizin or Radare2 with the Unicorn emulator so analysts can script emulation of the binary they are analyzing, for 32- and 64-bit x86, ARM and ARM64. Its interfaces emulate an instruction range or function with chosen register and stack values, force execution down the branches needed to reach target addresses or every cross-reference to a function, walk all paths through a function, run a standalone byte blob, or emulate from an address until nothing is left, with hooks on instructions and calls. A common use in its README is decrypting malware strings by emulating the decryption routine at each call site and commenting the results.","description_zh":"Mandiant FLARE 团队的 Python 库，把 IDA Pro、Rizin 或 Radare2 与 Unicorn 模拟器结合起来，让分析人员能以脚本方式模拟执行正在分析的二进制代码，支持 32/64 位 x86、ARM 和 ARM64。它提供的接口可在指定寄存器和栈值下模拟一段指令或一个函数，强制走到目标地址或某函数全部交叉引用所需的分支，遍历函数的所有路径，单独运行一段字节，或从某个地址一直模拟到没有代码可执行为止，并支持指令级和调用级钩子。README 中的常见用法是在每个调用点模拟恶意软件的字符串解密函数，并把解密结果写成注释。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"ida-pro","name":"IDA Pro","name_zh":"IDA Pro 交互式反汇编、反编译与调试工具","url":"https://hex-rays.com/ida-pro","evidence_url":"https://hex-rays.com/ida-pro","description_en":"Hex-Rays' commercial interactive disassembler, decompiler and debugger, which turns compiled code for more than 70 processor families into annotated, cross-referenced assembly and decompiled pseudocode. Its 15 decompilers cover 32- and 64-bit x86, ARM, MIPS, PowerPC and RISC-V as well as ARC, V850, TriCore, Hexagon and Android DEX; the Dalvik decompiler, new in IDA 9.5 alongside TriCore and Hexagon, renders DEX bytecode as Java pseudocode. Documented loaders include PE, ELF and Mach-O with Apple dyld shared caches and kernelcaches, DEX, UEFI firmware images, WebAssembly modules and console formats such as Xbox XBE, N64, SNES ROM and PlayStation PSX executables, and the processor list names console CPUs from the NES and Game Boy to the PlayStation 3 Cell, Xbox 360 Xenon and PSP Allegrex. The debugger runs locally or through remote debug servers for Windows, Linux, macOS and Android, and analysis can be scripted with IDAPython, IDC and the C++ SDK, run without a GUI through the idalib library, or driven from MCP clients through IDA MCP.","description_zh":"Hex-Rays 推出的商业交互式反汇编器、反编译器与调试器，可将 70 多个处理器家族的已编译代码转为带注释和交叉引用的汇编代码及反编译伪代码。其 15 款反编译器覆盖 32 位与 64 位的 x86、ARM、MIPS、PowerPC 和 RISC-V，以及 ARC、V850、TriCore、Hexagon 和 Android DEX；其中 Dalvik、TriCore 和 Hexagon 反编译器为 IDA 9.5 新增，Dalvik 反编译器可把 DEX 字节码还原为 Java 伪代码。文档列出的加载器支持 PE、ELF、Mach-O（含 Apple dyld 共享缓存和 kernelcache）、DEX、UEFI 固件镜像、WebAssembly 模块，以及 Xbox XBE、N64、SNES ROM 和 PlayStation PSX 可执行文件等游戏机格式；处理器列表也涵盖从 NES、Game Boy 到 PlayStation 3 的 Cell、Xbox 360 的 Xenon 和 PSP 的 Allegrex 等游戏机 CPU。调试器既可本地调试，也可通过远程调试服务器调试 Windows、Linux、macOS 和 Android 目标；分析可用 IDAPython、IDC 和 C++ SDK 编写脚本，借助 idalib 库在无图形界面的环境中运行，或通过 IDA MCP 交由 MCP 客户端驱动。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary","firmware","game"],"verified_at":"2026-11-05"},{"id":"binary-ninja","name":"Binary Ninja","name_zh":"Binary Ninja 交互式反汇编、反编译与二进制分析平台","url":"https://binary.ninja/","evidence_url":"https://binary.ninja/","description_en":"Vector 35's commercial interactive disassembler, decompiler and debugger, whose decompiler is built on the BNIL family of intermediate languages and shows either C or BNIL for every officially supported architecture. Depending on the edition it decompiles x86/x86-64, ARMv7/Thumb2, AArch64, PowerPC, MIPS, RISC-V, MSP430, 6502, nanoMIPS, TriCore, C-SKY, M·CORE, Hexagon, NDS32 and TMS320C6x, and it loads raw binaries and PE/COFF, ELF, Mach-O, TE, Intel HEX, Motorola S-Record, TI-TXT, MD1ROM and VxWorks files. C++, Python and Rust APIs automate analysis inside or outside the UI; the open-source debugger runs locally or remotely on Windows, Linux and macOS and also connects to GDB, LLDB and iOS debugserver targets; patches can be made by editing assembly, in the hex editor or with the bundled SCC compiler; and 6.0 added an MCP server. Ultimate adds Firmware Ninja for embedded firmware, which finds code and data regions by entropy and detects memory-mapped I/O accesses, while the EFI Resolver workflow types protocol usage in UEFI PEI, DXE and SMM modules.","description_zh":"Vector 35 推出的商业交互式反汇编器、反编译器与调试器，其反编译器建立在 BNIL 中间语言家族之上，可为所有官方支持的架构输出 C 或 BNIL。视版本不同，它可反编译 x86/x86-64、ARMv7/Thumb2、AArch64、PowerPC、MIPS、RISC-V、MSP430、6502、nanoMIPS、TriCore、C-SKY、M·CORE、Hexagon、NDS32 和 TMS320C6x，并能加载原始二进制以及 PE/COFF、ELF、Mach-O、TE、Intel HEX、Motorola S-Record、TI-TXT、MD1ROM 和 VxWorks 文件。C++、Python 和 Rust API 可在界面内外自动化分析；开源调试器可在 Windows、Linux 和 macOS 上本地或远程调试，也能连接 GDB、LLDB 和 iOS debugserver 目标；补丁可通过直接修改汇编、十六进制编辑器或内置的 SCC 编译器完成；6.0 版还加入了 MCP 服务器。Ultimate 版另含面向嵌入式固件的 Firmware Ninja，可按熵值识别代码与数据区域并检测对内存映射 I/O 的访问；EFI Resolver 工作流则为 UEFI 的 PEI、DXE 和 SMM 模块中的协议调用补全类型信息。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-11-05"},{"id":"hopper-disassembler","name":"Hopper Disassembler","name_zh":"Hopper Disassembler macOS/Linux 反汇编与反编译工具","url":"https://www.hopperapp.com/","evidence_url":"https://www.hopperapp.com/","description_en":"Cryptic Apps' commercial disassembler, decompiler and debugger for macOS and Linux, which reads Mach-O (macOS and iOS), PE and ELF executables built for 32- and 64-bit Intel, ARMv6, ARMv7, ARM64 and PowerPC processors. Each procedure can be viewed as assembly, as an interactive control-flow graph that exports to PDF or as C-like pseudocode, with Swift name demangling and extraction of Objective-C selectors and messages, and binaries can be patched through the hex editor, the built-in assembler or Python. Debugging of Mac applications uses LLDB or GDB, Python scripts reach most features, an SDK adds file-format parsers and CPU backends, and Hopper 6 brought a new decompiler and an MCP server for LLM clients.","description_zh":"Cryptic Apps 推出的商业反汇编器、反编译器与调试器，运行于 macOS 和 Linux，可读取面向 32/64 位 Intel、ARMv6、ARMv7、ARM64 和 PowerPC 处理器构建的 Mach-O（macOS 与 iOS）、PE 和 ELF 可执行文件。每个函数都能以汇编、可导出为 PDF 的交互式控制流图或类 C 伪代码呈现，并能还原 Swift 修饰名、提取 Objective-C 选择器与消息；还可通过十六进制编辑器、内置汇编器或 Python 修改二进制。调试 Mac 应用时可使用 LLDB 或 GDB；Python 脚本可调用大部分功能，SDK 可扩展文件格式解析器和 CPU 后端；Hopper 6 推出了新的反编译器以及供大语言模型客户端使用的 MCP 服务器。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-11-05"},{"id":"jeb-decompiler","name":"JEB Decompiler","name_zh":"JEB Decompiler Android 与原生代码逆向平台","url":"https://www.pnfsoftware.com/jeb/","evidence_url":"https://www.pnfsoftware.com/jeb/","description_en":"PNF Software's commercial reverse-engineering platform for Android apps and native code, combining a Dalvik decompiler and Android debuggers with disassemblers and decompilers for x86, ARM, MIPS and RISC-V machine code. For APKs it decompiles multi-dex Dalvik bytecode to Java, reconstructs resources and obfuscated XML, cleans up obfuscated code with optimizers that decrypt content and undo reflection, and debugs Dalvik and native ARM or Intel code in one session, stepping from Dalvik into JNI methods. Modules in JEB Pro also decompile WebAssembly, Ethereum EVM contracts (to Solidity-like code), Siemens S7-300/400 PLC blocks and Nvidia SASS GPU code and analyze PDF documents, and its loaders read PE, ELF, Mach-O, Intel HEX and raw (headless) firmware images. The JEB API lets Java and Python scripts, back-end plugins and custom headless clients automate analysis, and JEB also exposes an MCP server for AI agents.","description_zh":"PNF Software 推出的商业逆向工程平台，面向 Android 应用和原生代码，集 Dalvik 反编译器、Android 调试器以及 x86、ARM、MIPS、RISC-V 机器码的反汇编器与反编译器于一体。处理 APK 时，它能将多 dex 的 Dalvik 字节码反编译为 Java，重建资源和经过混淆的 XML，用可自动解密内容、消除反射调用的优化器清理混淆代码，并在同一会话中调试 Dalvik 与原生 ARM 或 Intel 代码，可从 Dalvik 单步进入 JNI 方法。JEB Pro 的模块还能反编译 WebAssembly、以太坊 EVM 合约（输出类 Solidity 代码）、西门子 S7-300/400 PLC 程序块和 Nvidia SASS GPU 代码，并分析 PDF 文档；其加载器可读取 PE、ELF、Mach-O、Intel HEX 以及无容器格式（headless）的固件镜像。借助 JEB API，可用 Java 和 Python 编写脚本、后端插件和自定义无界面客户端来自动化分析；JEB 还提供面向 AI 智能体的 MCP 服务器。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","binary","firmware"],"verified_at":"2026-11-05"},{"id":"windbg","name":"WinDbg","name_zh":"WinDbg Windows 调试器","url":"https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/","evidence_url":"https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/","description_en":"Microsoft's WinDbg debugger and the Debugging Tools for Windows, documented on Microsoft Learn, for debugging live user-mode and kernel-mode code, analyzing crash dumps and examining CPU registers and memory. The current app keeps the engine, commands and extensions of WinDbg (Classic) and adds Time Travel Debugging, which records a user-mode process and replays it in both directions, JavaScript and NatVis scripting and Linux ELF dump analysis; since 1.2610.1001.0 it also offers WinDbg MCP for supported AI clients.","description_zh":"微软的 WinDbg 调试器及 Debugging Tools for Windows 工具包，文档发布于 Microsoft Learn，用于调试运行中的用户态和内核态代码、分析崩溃转储，以及检查 CPU 寄存器和内存。当前的 WinDbg 应用沿用 WinDbg (Classic) 的调试引擎、命令和扩展，并新增时间旅行调试（Time Travel Debugging，可录制用户态进程并向前、向后回放）、JavaScript 与 NatVis 脚本和 Linux ELF 转储分析；自 1.2610.1001.0 版起还提供面向受支持 AI 客户端的 WinDbg MCP。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"010-editor","name":"010 Editor","name_zh":"010 Editor 十六进制与文本编辑器","url":"https://www.sweetscape.com/010editor/","evidence_url":"https://www.sweetscape.com/010editor/","description_en":"SweetScape Software's commercial hex and text editor whose Binary Templates, C/C++-like struct definitions with control flow and functions, parse binary files into hierarchical, editable structures. Templates can run when a file opens and are shared through an online repository, scripts with C/C++-like syntax automate edits and batch runs, and the tools include a Capstone-based disassembler for x86, ARM, MIPS, PowerPC and other code, byte-by-byte comparison, checksums and hashes, and editing of drives and, on Windows, process memory.","description_zh":"SweetScape Software 推出的商业十六进制与文本编辑器，其 Binary Templates 采用类似 C/C++ 结构体、可含控制流语句和函数的写法，将二进制文件解析为可编辑的层级结构。模板可在打开文件时自动运行，并能通过在线仓库分享；语法类似 C/C++ 的脚本可自动完成编辑和批处理；工具还包括基于 Capstone、支持 x86、ARM、MIPS、PowerPC 等架构的反汇编器、逐字节比较、校验和与哈希计算，以及磁盘和 Windows 进程内存编辑。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"pestudio","name":"pestudio","name_zh":"pestudio 恶意软件初步评估工具","url":"https://www.winitor.com/","evidence_url":"https://www.winitor.com/","description_en":"Winitor's Windows tool for initial malware assessment, which statically inspects Windows executable files and reports key indicators such as hard-coded URLs and IP addresses, flagged imports, resources and overlay data. The free basic edition also detects file signatures, debug information and TLS callbacks, computes entropy and imphash, shows the rich header and .NET metadata and looks up VirusTotal scores by hash; pestudio-pro adds MITRE ATT&CK mapping, XML reports and the pestudiox.exe command-line version.","description_zh":"Winitor 推出的 Windows 恶意软件初步评估工具，以静态方式检查 Windows 可执行文件，报告硬编码的 URL 和 IP 地址、被标记的导入函数、资源及附加数据（overlay）等关键指标。免费的基础版还能识别文件签名、调试信息和 TLS 回调，计算熵值与 imphash，显示 rich header 和 .NET 元数据，并凭哈希查询 VirusTotal 评分；pestudio-pro 另提供 MITRE ATT&CK 映射、XML 报告和命令行版本 pestudiox.exe。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"ollydbg","name":"OllyDbg","name_zh":"OllyDbg Windows 32 位调试器","url":"https://www.ollydbg.de/","evidence_url":"https://www.ollydbg.de/viewer.htm","description_en":"32-bit assembler-level analyzing debugger for Windows that emphasizes binary code analysis for programs without source; its site says development is frozen, and the newest version it lists is 2.01 of 27 September 2013. Its analysis recognizes procedures, loops, API calls, switches, tables, constants and strings and decodes calls to more than 1,900 standard API and 400 C functions; it attaches to running programs, debugs DLLs directly, sets conditional, logging, memory and hardware breakpoints and writes patches back to the executable.","description_zh":"面向 Windows 的 32 位汇编级分析型调试器，侧重二进制代码分析，适用于没有源码的程序；其网站称开发已冻结，列出的最新版本是 2013 年 9 月 27 日发布的 2.01。它能识别过程、循环、API 调用、switch 结构、表、常量和字符串，解码对 1900 多个标准 API 和 400 个 C 函数的调用；还可附加到运行中的程序、直接调试 DLL，设置条件、日志、内存和硬件断点，并把补丁写回可执行文件。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"practical-malware-analysis","name":"Practical Malware Analysis","name_zh":"《Practical Malware Analysis》恶意软件分析实战指南","url":"https://nostarch.com/malware","evidence_url":"https://nostarch.com/malware","description_en":"No Starch Press book, published in February 2012, that teaches hands-on malware analysis from basic static and dynamic techniques in virtual machines through x86 disassembly with IDA Pro, debugging with OllyDbg and kernel debugging with WinDbg. Later chapters cover malicious Windows programs, covert launching, data encoding, network signatures, anti-disassembly, anti-debugging and anti-VM techniques, unpacking, shellcode, C++ and 64-bit malware, and hands-on labs with solutions have readers dissect malware samples.","description_zh":"No Starch Press 于 2012 年 2 月出版的书籍，以动手实践的方式讲解恶意软件分析：从在虚拟机中运用基础静态与动态分析技术入手，进而讲解用 IDA Pro 进行 x86 反汇编、用 OllyDbg 调试以及用 WinDbg 进行内核调试。后续章节涵盖恶意 Windows 程序、隐蔽启动、数据编码、网络特征、反反汇编、反调试与反虚拟机技术、脱壳、shellcode、C++ 和 64 位恶意软件；书中配有附解答的动手实验，让读者剖析恶意软件样本。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-11-05"},{"id":"uabea","name":"UABEA","name_zh":"UABEA Unity 资源包读写工具","url":"https://github.com/nesrak1/UABEA","evidence_url":"https://github.com/nesrak1/UABEA/blob/057e2f6ae67ebc94a38faca9f946f8577162fa99/readme.md","description_en":"Cross-platform reader and writer for the asset bundles and serialized asset files of Unity games, originally based on, though not a fork of, the archived UABE. Its README presents it as a modding and research tool rather than an extractor and points users who only want to extract assets to AssetRipper or AssetStudio; it opens bundles from Unity's Addressables system, whose CRC checks must be cleared with a separate tool before edited bundles load. It builds on AssetsTools.NET with Cpp2IL and Mono.Cecil, and the repository includes texture, audio-clip, font and text-asset plugins.","description_zh":"跨平台的 Unity 游戏资源包（asset bundle）与序列化资源文件读写工具，最初参照已归档的 UABE 编写，但并非其分支。README 将它定位为改造（modding）与研究工具而非提取工具，只想提取资源的用户可改用 AssetRipper 或 AssetStudio；它能打开 Unity Addressables 系统使用的资源包，但修改后的资源包须先用另一个工具清除 CRC 校验才能加载。它基于 AssetsTools.NET，并借助 Cpp2IL 和 Mono.Cecil；仓库中还附有纹理、音频片段、字体和文本资源插件。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-05"},{"id":"tenet","name":"Tenet","name_zh":"Tenet IDA Pro 执行跟踪浏览插件","url":"https://github.com/gaasedelen/tenet","evidence_url":"https://github.com/gaasedelen/tenet/blob/62c0bec073fcbb31c5be52c9ea236b6ea2bcc418/README.md","description_en":"IDA Pro plugin for exploring execution traces of a binary: it loads an externally recorded trace and lets the analyst step forwards and backwards through time while the disassembly shows the execution flow in both directions. Execution, memory and region breakpoints mark every execution of an instruction or every read and write of an address or range along a trace timeline, register seeking jumps to the instruction that set a register's value, and a timestamp shell seeks to a position or percentage of the trace.","description_zh":"用于浏览二进制程序执行跟踪的 IDA Pro 插件：载入外部录制的跟踪后，分析人员可沿时间轴向前或向后单步，反汇编视图会标出前后两个方向的执行流。执行断点、内存断点和区域断点可在跟踪时间轴上标出某条指令的每次执行，或某个地址、某段内存的每次读写；寄存器回溯可直接跳到设置该寄存器当前值的指令；时间戳命令行可跳转到跟踪中的指定位置或百分比处。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"findcrypt-yara","name":"findcrypt-yara","name_zh":"findcrypt-yara IDA Pro 密码学常量识别插件","url":"https://github.com/polymorf/findcrypt-yara","evidence_url":"https://github.com/polymorf/findcrypt-yara/blob/044644b9c52ae3e7b2305bac15b0c12c9e31a282/README.md","description_en":"IDA Pro plugin that scans the loaded database with YARA rules for cryptographic constants and similar signatures, lists the matches in a results window and names each matching address after its rule. Its bundled findcrypt3.rules has 126 rules covering constants and tables of hash, cipher and checksum algorithms such as MD5, SHA-1, SHA-256, SHA-512, RIPEMD-160, Whirlpool, DES, Blowfish, RC6, TEA and CRC32, big-number and prime constants, crypto API names and functions of libraries such as OpenSSL, Crypto++, MIRACL and FGint; users can add their own .rules files.","description_zh":"IDA Pro 插件，用 YARA 规则在已加载的数据库中扫描密码学常量等特征，在结果窗口中列出匹配项，并按规则名为每个匹配地址命名。随附的 findcrypt3.rules 包含 126 条规则，涵盖 MD5、SHA-1、SHA-256、SHA-512、RIPEMD-160、Whirlpool、DES、Blowfish、RC6、TEA 和 CRC32 等哈希、加密与校验算法的常量和查找表，大数与素数常量，加密 API 名称，以及 OpenSSL、Crypto++、MIRACL 和 FGint 等库中的函数；用户还可添加自己的 .rules 文件。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"dereferencing","name":"deREferencing","name_zh":"deREferencing IDA Pro 寄存器与栈视图插件","url":"https://github.com/danigargu/deREferencing","evidence_url":"https://github.com/danigargu/deREferencing/blob/797a6156b538f3374de1147c8fe68788ec2d9020/README.md","description_en":"IDA Pro plugin that adds register and stack views to the debugger in which pointers are dereferenced and colored, similar to the context displays of GDB plugins such as PEDA, GEF and pwndbg. It supports x86, x86-64, ARM, ARM64, MIPS32 and MIPS64; both views open from Debugger > Debugger Windows or with Alt-Shift-D and Alt-Shift-E, and a saved desktop layout reopens them in later debugging sessions.","description_zh":"为 IDA Pro 调试器新增寄存器视图和栈视图的插件，视图中会显示解引用后的指针并加以着色，效果类似 PEDA、GEF、pwndbg 等 GDB 插件的上下文显示。它支持 x86、x86-64、ARM、ARM64、MIPS32 和 MIPS64；两个视图可从 Debugger > Debugger Windows 菜单或用 Alt-Shift-D、Alt-Shift-E 快捷键打开，保存桌面布局后，之后的调试会话会自动重新打开它们。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"hexrays-toolbox","name":"HexRays Toolbox","name_zh":"HexRays Toolbox 反编译代码模式查询脚本","url":"https://github.com/patois/HexraysToolbox","evidence_url":"https://github.com/patois/HexraysToolbox/blob/d04869a3d6098a4ae4f60989d455d4bf3e572bad/Readme.md","description_en":"IDAPython scripts that find code patterns in Hex-Rays decompiler output, independent of the binary's processor architecture, by running user-written lambda queries over the decompiled ctree. Queries run from the hxtb-shell GUI inside IDA, from IDAPython through functions such as find_expr() and find_item(), from interactive command-line helpers or in batch mode over a set of files. The README's use cases include finding vulnerabilities and their variants, locating code patterns from previously reversed executables in newly decompiled code, malware variant analysis and finding patterns across binaries built for different architectures.","description_zh":"一组 IDAPython 脚本，通过对反编译得到的 ctree 运行用户编写的 lambda 查询，在 Hex-Rays 反编译输出中查找代码模式，与二进制文件的处理器架构无关。查询可在 IDA 内的 hxtb-shell 图形界面中运行，也可在 IDAPython 中通过 find_expr()、find_item() 等函数调用，或借助交互式命令行辅助函数运行，还能以批处理方式对一组文件执行。README 列出的用途包括查找漏洞及其变种、在新反编译的代码中定位此前逆向过的程序里的代码模式、恶意软件变种分析，以及在为不同架构编译的二进制文件之间查找相同模式。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"virtuailor","name":"Virtuailor","name_zh":"Virtuailor IDA Pro C++ 虚表重建工具","url":"https://github.com/0xgalz/Virtuailor","evidence_url":"https://github.com/0xgalz/Virtuailor/blob/f5e20a021e31d4fdc40bf7fa531c8038ba240095/README.md","description_en":"IDAPython tool that reconstructs C++ virtual tables in IDA Pro for 32- and 64-bit Intel and AArch64 code by observing indirect calls while the program runs under IDA's debugger. Its static part finds indirect calls and hooks the assignment of their targets with conditional breakpoints; when those breakpoints hit, the dynamic part creates vtable structures, renames vtables and virtual functions, adds structure offsets to the call instructions and cross-references from each indirect call to the virtual functions it reached, and for AArch64 firmware tries to fix undefined vtables and their functions.","description_zh":"在 IDA Pro 中重建 C++ 虚函数表的 IDAPython 工具，适用于 32/64 位 Intel 和 AArch64 代码，通过在 IDA 调试器中运行程序并观察间接调用来完成。静态部分负责找出间接调用，并用条件断点挂钩其调用目标的赋值；断点命中后，动态部分会创建虚表结构体、重命名虚表和虚函数、为调用指令加上结构体偏移，并从每个间接调用添加指向其实际调用的虚函数的交叉引用；对 AArch64 固件，它还会尝试修复未定义的虚表及相关函数。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-11-05"},{"id":"xanalyzer","name":"xAnalyzer","name_zh":"xAnalyzer x64dbg 代码分析插件","url":"https://github.com/ThunderCls/xAnalyzer","evidence_url":"https://github.com/ThunderCls/xAnalyzer/blob/09b7742ecf8e4beb2a2818371f0f25c8ded917db/README.md","description_en":"x64dbg plugin that annotates the static code of the debugged x86 or x64 executable with function-call, argument and loop analysis. It adds argument and type information from over 13,000 API definitions for almost 200 DLLs, handles undefined and register-based calls generically and detects loops automatically. Analysis runs on a selection, a function or a whole module from menus or the xanal commands, can run automatically at the entry point like OllyDbg's initial analysis, and users can extend its .api and header definition files.","description_zh":"x64dbg 插件，为被调试的 x86 或 x64 可执行文件的静态代码添加函数调用、参数和循环分析注释。它依据覆盖近 200 个 DLL、超过 13,000 个 API 的定义补充参数和类型信息，对未定义的调用和基于寄存器的调用做通用处理，并自动识别循环。分析可通过菜单或 xanal 命令作用于选中范围、单个函数或整个模块，也可像 OllyDbg 的初始分析那样在到达入口点时自动执行；用户还可以自行扩充其 .api 定义文件和头文件。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"assetstudio","name":"AssetStudio","name_zh":"AssetStudio Unity 资源浏览与导出工具","url":"https://github.com/Perfare/AssetStudio","evidence_url":"https://github.com/Perfare/AssetStudio/blob/d158e864b556b5970709c2a52e47944d53aa98a2/README.md","description_en":"Tool for exploring, extracting and exporting the assets and asset bundles of Unity versions 3.4 to 2022.1. It converts Texture2D and Sprite images to PNG, TGA, JPEG or BMP and AudioClip to MP3, OGG, WAV, M4A or FSB, with FSB-to-WAV conversion, and exports fonts, meshes as OBJ, text assets, shaders, movie and video clips and MonoBehaviour data as JSON; models export from the scene hierarchy, and Animators export to FBX with their bound AnimationClips. MonoBehaviour export asks for the folder holding the assemblies, such as Managed, or, for IL2CPP builds, the dummy DLLs that Il2CppDumper generates.","description_zh":"用于浏览、提取和导出 Unity 3.4 至 2022.1 版本资源与资源包（asset bundle）的工具。它可把 Texture2D 和 Sprite 图像转换为 PNG、TGA、JPEG 或 BMP，把 AudioClip 转换为 MP3、OGG、WAV、M4A 或 FSB（并支持将 FSB 转为 WAV），还能导出字体、OBJ 格式网格、文本资源、着色器、影片与视频片段，以及 JSON 格式的 MonoBehaviour 数据；模型可从场景层级中导出，Animator 可连同绑定的 AnimationClip 导出为 FBX。导出 MonoBehaviour 时需要指定程序集所在目录（如 Managed 文件夹），IL2CPP 构建则需改选 Il2CppDumper 生成的 dummy DLL 目录。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-05"},{"id":"voltron","name":"Voltron","name_zh":"Voltron 调试器界面扩展工具包","url":"https://github.com/snare/voltron","evidence_url":"https://github.com/snare/voltron/blob/be9e54b109380a21e4ec7ec9b3ecc9d4a7fd6529/README.md","description_en":"Extensible Python debugger UI toolkit that attaches utility views to LLDB, GDB, VDB and WinDbg/CDB sessions. Each view retrieves data from the debugger host and can run in its own terminal, so users can assemble a custom debugger interface; built-in views cover registers, disassembly, stack, memory, breakpoints and backtrace, and any debugger command can be split off into a view highlighted with a chosen Pygments lexer. The views complement the debugger's command line rather than replace it.","description_zh":"可扩展的 Python 调试器界面工具包，能为 LLDB、GDB、VDB 和 WinDbg/CDB 会话附加实用视图。每个视图从调试器宿主获取数据，并可在单独的终端中运行，使用者可借此组合出自己的调试界面；内置视图涵盖寄存器、反汇编、栈、内存、断点和调用栈回溯，任意调试器命令都能拆分成独立视图，并用指定的 Pygments 词法分析器高亮显示。这些视图是对调试器命令行的补充，而不是替代。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-05"},{"id":"remill","name":"Remill","name_zh":"Remill 机器码到 LLVM bitcode 提升库","url":"https://github.com/lifting-bits/remill","evidence_url":"https://github.com/lifting-bits/remill/blob/56918a8c2554088e93389e97d292f4035286506c/README.md","description_en":"Static binary translation library that lifts AArch64, SPARC32, SPARC64, x86 and amd64 machine code, including AVX and AVX512, into LLVM bitcode, with AArch32 support underway. It focuses on lifting individual instructions accurately and is meant as a library for other tools such as McSema; its documentation walks through how an instruction is lifted, how instruction semantics are implemented and the overall design.","description_zh":"静态二进制翻译库，可把 AArch64、SPARC32、SPARC64、x86 和 amd64 机器码（包括 AVX 与 AVX512 指令）提升为 LLVM bitcode，AArch32 支持正在开发中。它专注于准确提升单条指令，定位是供 McSema 等其他工具调用的库；文档逐步介绍了一条指令如何被提升、如何实现指令语义以及整体设计。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"iaito","name":"iaito","name_zh":"iaito radare2 官方图形界面","url":"https://github.com/radareorg/iaito","evidence_url":"https://github.com/radareorg/iaito/blob/a043f93e727a76d12496858fafa782ec2da65145/README.md","description_en":"Official Qt-based graphical interface for the radare2 reverse-engineering framework, aiming for parity with radare2's commands, features and keybindings so that existing r2 plugins and scripts keep working. Its README lists forensics, binary diffing and binary patching alongside disassembly; iaito was the original name before the project was forked as Cutter.","description_zh":"radare2 逆向工程框架的官方图形界面，基于 Qt 构建，力求在命令、功能和快捷键上与 radare2 保持一致，现有的 r2 插件和脚本都能继续使用。README 列出的功能除反汇编外，还包括取证分析、二进制对比和二进制修补；iaito 是该项目被分叉为 Cutter 之前的原名。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"hexrays-codexplorer","name":"HexRaysCodeXplorer","name_zh":"HexRaysCodeXplorer C++ 代码重建插件","url":"https://github.com/REhints/HexRaysCodeXplorer","evidence_url":"https://github.com/REhints/HexRaysCodeXplorer/blob/dc48267360ca06c494b234f30f6764499c27c1e9/README.md","description_en":"Hex-Rays decompiler plugin for navigating and reconstructing C++ code in IDA's pseudocode window. It reconstructs C++ object types from a selected pointer variable into IDA's local types, identifies virtual function tables and generates structures for them, lets the analyst click through virtual calls once objects are typed, visualizes a function's ctree as a graph, jumps from a pseudocode line to its disassembly and dumps ctrees and types to files. Its Object Explorer lists vtables with cross-references and RTTI parsing, and a batch mode processes many files without user interaction.","description_zh":"用于在 IDA 伪代码窗口中浏览和重建 C++ 代码的 Hex-Rays 反编译器插件。它能根据选中的指针变量重建 C++ 对象类型并存入 IDA 本地类型，识别虚函数表并为其生成结构体，在对象类型确定后可直接点击跳转到虚函数调用，以图形方式展示函数的 ctree，从伪代码行跳转到对应的反汇编，并把 ctree 和类型导出到文件。其 Object Explorer 可列出虚表及其交叉引用并解析 RTTI，批处理模式可在无人干预的情况下处理大量文件。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"vgmstream","name":"vgmstream","name_zh":"vgmstream 游戏音频格式解码库","url":"https://github.com/vgmstream/vgmstream","evidence_url":"https://github.com/vgmstream/vgmstream/blob/6802153425adde134e49394fc653455166d7d2f2/README.md","description_en":"Library and tools that decode streamed, prerecorded video game audio in hundreds of formats and codecs, from common game engine files to single-game codecs, including looped music, subsongs, companion files, custom containers and encryption keys. TXTH text descriptors add support for further formats, including raw audio, and TXTP files set per-file options such as forced looping or merging files. It ships as the vgmstream-cli decoder, which converts supported files to WAV, the vgmstream123 player and plugins for Winamp, foobar2000, XMPlay and Audacious, and an online web player is available at vgmstream.org.","description_zh":"用于解码电子游戏中流式预录音频的库与工具，支持数百种格式和编解码器，从常见的游戏引擎文件到单款游戏专用的编解码器，并能处理循环音乐、子曲目、配套文件、自定义容器和加密密钥。借助 TXTH 文本描述文件可为更多格式（包括原始音频）添加支持，TXTP 文件则可为单个文件设置强制循环、合并多个文件等选项。它提供 vgmstream-cli 解码器（可把受支持的文件转换为 WAV）、vgmstream123 播放器，以及 Winamp、foobar2000、XMPlay 和 Audacious 插件，vgmstream.org 上还有在线网页播放器。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"payload-dumper","name":"payload dumper","name_zh":"payload dumper Android OTA 分区镜像提取工具","url":"https://github.com/vm03/payload_dumper","evidence_url":"https://github.com/vm03/payload_dumper/blob/2f0a964b8b77c6244e3e12735f85539c938f9c97/README.md","description_en":"Python script that extracts the partition images, such as boot.img and system.img, from the payload.bin inside an Android OTA update package. It handles full OTAs directly and incremental OTAs with --diff by applying the update to original images that the user copies from a full OTA or dumps from the device, and it can also run from a Docker image.","description_zh":"从 Android OTA 更新包内的 payload.bin 中提取 boot.img、system.img 等分区镜像的 Python 脚本。完整 OTA 可直接提取；增量 OTA 则需加 --diff，并由使用者提供从完整 OTA 中取得或从设备上转储的原始镜像，脚本会在其基础上应用更新。它也可以通过 Docker 镜像运行。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"malware-training-vol1","name":"Windows Malware Analysis training, volume 1 (malware_training_vol1)","name_zh":"Windows 恶意软件分析培训第一卷（malware_training_vol1）","url":"https://github.com/hasherezade/malware_training_vol1","evidence_url":"https://github.com/hasherezade/malware_training_vol1/blob/acf72d45009140fed514c1dfa429122f01a2f6c0/README.md","description_en":"Slides and exercises for a Windows malware analysis training that builds an understanding of common malware techniques through programming, reverse engineering and Windows internals, and shows how analysis tools are used for particular goals. Module 1 covers compilation, the PE format, processes, WoW64, shellcode and PE loaders; module 2 introduces malware missions and tactics, hooking, persistence and banking trojans; module 3 introduces evasion and self-defence and fingerprinting, with obfuscation, anti-hooking, deobfuscation and kernel-mode components planned.","description_zh":"一套 Windows 恶意软件分析培训的幻灯片与练习，通过编程、逆向工程和 Windows 内部机制帮助学员理解常见的恶意软件技术，并演示如何用各种分析工具达成特定分析目标。第 1 单元涵盖编译、PE 格式、进程、WoW64、shellcode 和 PE 加载器；第 2 单元介绍恶意软件的目标与战术、挂钩、持久化和银行木马；第 3 单元介绍规避与自我保护以及指纹识别，混淆、反挂钩、反混淆和内核态组件等内容尚在计划中。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-11-06"},{"id":"ida-no-mcp","name":"IDA NO MCP","name_zh":"IDA NO MCP：面向 AI 编程工具的 IDA 反编译导出工具","url":"https://github.com/P4nda0s/IDA-NO-MCP","evidence_url":"https://github.com/P4nda0s/IDA-NO-MCP/blob/2a48a91da706eb778761bfd47e5bb9dde8b651fb/README_EN.md","description_en":"IDA Pro exporter that turns an analyzed binary into plain files for AI coding tools such as Cursor or Claude Code instead of serving it over MCP. It writes each decompiled function as a .c file, or as .asm when decompilation fails, under a header listing its name, address, callers and callees, along with the string, import and export tables, 1 MB hexdump chunks of every segment and logs of fallbacks, failures and skipped library functions. It ships as an IDA plugin (Export for AI, Ctrl-Shift-E) for small and medium files and as a Rust command-line binary for large or batch exports, which can skip IDA's auto-analysis.","description_zh":"IDA Pro 导出工具，不走 MCP，而是把分析好的二进制导出为普通文件，交给 Cursor、Claude Code 等 AI 编程工具使用。它把每个反编译成功的函数写成一个 .c 文件（反编译失败时改为 .asm），文件头列出函数名、地址、调用者和被调用者；同时导出字符串表、导入表和导出表，按 1 MB 分块输出各段内存的十六进制转储，并记录回退、失败和被跳过的库函数。它提供两种形态：适合中小文件的 IDA 插件（Export for AI，快捷键 Ctrl-Shift-E），以及适合大文件或批量导出、可跳过 IDA 自动分析的 Rust 命令行程序。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-11-05"},{"id":"ida-mcp-rs","name":"ida-mcp-rs","name_zh":"ida-mcp-rs 无界面 IDA Pro MCP 服务器","url":"https://github.com/blacktop/ida-mcp-rs","evidence_url":"https://github.com/blacktop/ida-mcp-rs/blob/7a81b9a41d3c7d7b7c62547929b8c46f38a5c54a/README.md","description_en":"Headless MCP server written in Rust that drives IDA Pro through idalib, so agents such as Claude Code, Codex CLI, Gemini CLI or Cursor can open and analyze binaries without the IDA GUI. Apple targets are single tool calls, including universal Mach-O slice selection, dSYM/DWARF loading and dyld_shared_cache module loading; a 28-tool lean profile sits beside the full tool set, run_script executes IDAPython and returns JSON, and editing tools such as rename, comments, patches and type application each take exactly one address or exact symbol name. save_idb writes checkpoints, and crashed or wedged IDA workers are replaced automatically.","description_zh":"用 Rust 编写的无界面 MCP 服务器，通过 idalib 驱动 IDA Pro，让 Claude Code、Codex CLI、Gemini CLI、Cursor 等智能体无需 IDA 图形界面即可打开和分析二进制文件。针对 Apple 目标的操作只需一次工具调用，包括选择通用 Mach-O 中的架构切片、加载 dSYM/DWARF 以及从 dyld_shared_cache 加载模块；除完整工具集外还提供 28 个工具的精简配置，run_script 可执行 IDAPython 并以 JSON 返回结果；重命名、注释、补丁和类型应用等修改类工具每次只接受一个地址或精确的符号名。save_idb 可写入检查点，崩溃或卡死的 IDA 工作进程会被自动替换。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-11-05"},{"id":"ida-multi-mcp","name":"ida-multi-mcp","name_zh":"ida-multi-mcp 多实例 IDA Pro MCP 服务器","url":"https://github.com/MeroZemory/ida-multi-mcp","evidence_url":"https://github.com/MeroZemory/ida-multi-mcp/blob/8ff883109fc3ce614d1e59718a53b02a0634c542/README.md","description_en":"MCP server that lets an agent analyze several IDA Pro databases at once through one endpoint. Each database with its plugin registers itself when opened and headless idalib sessions can be added, and a router exposes up to 76 tools for triage, decompilation and disassembly, cross-references and call graphs, search, types, renaming, comments and patching, plus analysis-wait gating so agents can wait for IDA's auto-analysis to settle; its IDA tool implementations come from the ida-pro-mcp project. Function-similarity search compares functions within or across binaries using name-independent instruction MinHash, API, string and constant anchors and control-flow shape, with optional local neural recall, and nothing is uploaded.","description_zh":"让智能体通过同一个端点同时分析多个 IDA Pro 数据库的 MCP 服务器。装有其插件的数据库在打开时会自动注册，也可加入无界面的 idalib 会话；路由器最多提供 76 个工具，涵盖初步分析、反编译与反汇编、交叉引用与调用图、搜索、类型、重命名、注释和补丁，并提供等待自动分析完成的机制，让智能体在 IDA 分析稳定后再下结论；其 IDA 工具实现来自 ida-pro-mcp 项目。函数相似度搜索可在单个二进制内或跨二进制比较函数，依据不依赖函数名的指令 MinHash、API/字符串/常量锚点和控制流结构，并可选用本地神经网络召回，不会上传任何数据。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-11-05"},{"id":"x64dbgmcp","name":"x64dbg MCP (x64dbgMCP)","name_zh":"x64dbg MCP（x64dbgMCP）调试器 MCP 服务器","url":"https://github.com/Wasdubya/x64dbgMCP","evidence_url":"https://github.com/Wasdubya/x64dbgMCP/blob/e7474e57d34aacf533d29e5778361637afef936a/README.md","description_en":"MCP server that connects LLM clients to the x64dbg and x32dbg debuggers through a native plugin and a Python MCP script. It exposes more than 40 tools built on the x64dbg SDK and was tested with Claude and Cursor; agents can query registers, search byte patterns in a module and drive debugging sessions. The README advises giving the model the executable's full path so it can restart a crashed or hung target through the command-execution tool, and starting from GetModuleBase so that queries use valid addresses.","description_zh":"通过原生插件和 Python MCP 脚本把 LLM 客户端连接到 x64dbg 与 x32dbg 调试器的 MCP 服务器。它提供 40 多个基于 x64dbg SDK 的工具，已用 Claude 和 Cursor 测试；智能体可以查询寄存器、在模块中搜索字节模式并控制调试会话。README 建议把可执行文件的完整路径告诉模型，以便它在目标崩溃或卡住时通过命令执行工具重新启动，并建议从 GetModuleBase 开始，以确保查询使用有效地址。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-11-05"},{"id":"idasql","name":"IDASQL","name_zh":"IDASQL IDA Pro 数据库 SQL 接口","url":"https://github.com/allthingsida/idasql","evidence_url":"https://github.com/allthingsida/idasql/blob/6212ece62569bcb88d9c28544e4ef71a64ed2d53/README.md","description_en":"SQL interface to IDA Pro databases that exposes a binary's analysis as more than 30 live virtual tables for agents and scripts. The tables cover functions, segments, names, imports, cross-references, basic blocks, instructions, strings, types, decompilation and annotations, and part of the database can be edited through them. It runs as a standalone CLI that can open raw binaries through idalib, as a plugin in IDA's command-line dropdown, as an HTTP REST or MCP server, or through a skills plugin for Claude Code, GitHub Copilot CLI and Codex, and it can work across several databases at once.","description_zh":"IDA Pro 数据库的 SQL 接口，把二进制的分析结果以 30 多张实时虚拟表的形式提供给智能体和脚本。这些表涵盖函数、段、名称、导入、交叉引用、基本块、指令、字符串、类型、反编译结果和注释，部分数据库内容也可通过它们修改。它可作为独立命令行程序运行（可借助 idalib 打开原始二进制文件），也可作为 IDA 命令行下拉菜单中的插件、HTTP REST 服务器或 MCP 服务器使用，还能通过面向 Claude Code、GitHub Copilot CLI 和 Codex 的技能插件使用，并支持同时处理多个数据库。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-11-05"},{"id":"luyten","name":"Luyten","name_zh":"Luyten Java 反编译器图形界面","url":"https://github.com/deathmarine/Luyten","evidence_url":"https://github.com/deathmarine/Luyten/blob/64af8d1df1d2cab029779142726fbcd8bc482956/ReadMe.md","description_en":"Graphical Java decompiler front end for the Procyon decompiler, with its editor view powered by RSyntaxTextArea.","description_zh":"Procyon 反编译器的图形界面前端，编辑视图由 RSyntaxTextArea 驱动。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"gdb-dashboard","name":"GDB dashboard","name_zh":"GDB dashboard 调试状态界面","url":"https://github.com/cyrus-and/gdb-dashboard","evidence_url":"https://github.com/cyrus-and/gdb-dashboard/blob/7b9b1260a8b3e9dd57b6cbf302bdfba71cec4014/README.md","description_en":"Standalone .gdbinit file written with GDB's Python API that shows a modular status interface each time the debugged program stops, reducing the commands needed to inspect its state. No GDB command is redefined; its features sit under a single dashboard command.","description_zh":"用 GDB Python API 编写的独立 .gdbinit 文件，被调试程序每次停下时显示模块化的状态界面，减少查看程序状态所需的命令。它不重定义任何 GDB 命令，所有功能都集中在 dashboard 命令之下。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"rehex","name":"REHex","name_zh":"REHex 逆向工程十六进制编辑器","url":"https://github.com/solemnwarning/rehex","evidence_url":"https://github.com/solemnwarning/rehex/blob/1e4fcd437700083cf36e5cbfe20da13577ab5fef/README.md","description_en":"Cross-platform hex editor for reverse engineering that handles files over 1 TB. It adds inline disassembly, integer and floating-point decoding, byte-range annotations, side-by-side comparison, virtual address mapping and bitmap visualisation, with Binary Templates that annotate data automatically and Lua scripting.","description_zh":"面向逆向工程的跨平台十六进制编辑器，可处理超过 1 TB 的文件。它提供内联反汇编、整数与浮点数解码、字节范围标注、并排比较、虚拟地址映射和位图可视化，还支持自动标注数据的 Binary Templates 和 Lua 脚本。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"dobby","name":"Dobby","name_zh":"Dobby 跨平台钩子框架","url":"https://github.com/jmpews/Dobby","evidence_url":"https://github.com/jmpews/Dobby/blob/5dfc8546954ce3b3198132ab13fddb89ee92cdd7/README.md","description_en":"Lightweight, modular hook framework for Windows, macOS, iOS, Android and Linux on x86, x86-64, ARM and ARM64.","description_zh":"轻量的模块化钩子框架，支持 Windows、macOS、iOS、Android 和 Linux，覆盖 x86、x86-64、ARM 和 ARM64 架构。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"xlmmacrodeobfuscator","name":"XLMMacroDeobfuscator","name_zh":"XLMMacroDeobfuscator Excel 4.0 宏解码工具","url":"https://github.com/DissectMalware/XLMMacroDeobfuscator","evidence_url":"https://github.com/DissectMalware/XLMMacroDeobfuscator/blob/43114164d89b8b3b426144f1fdfeb2ca75d28b92/README.md","description_en":"Command-line tool and Python library that extracts and decodes obfuscated Excel 4.0 (XLM) macros from xls, xlsm and xlsb files. An internal XLM emulator interprets the macros without fully performing the code, and results can be exported as JSON.","description_zh":"用于从 xls、xlsm 和 xlsb 文件中提取并解码混淆 Excel 4.0（XLM）宏的命令行工具和 Python 库。内置的 XLM 模拟器解释宏，但不完整执行其代码，结果可导出为 JSON。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"pe-tree","name":"PE Tree","name_zh":"PE Tree 可执行文件树状查看器","url":"https://github.com/blackberry/pe_tree","evidence_url":"https://github.com/blackberry/pe_tree/blob/2be607fc55702293cd02cbc6cda5283452464aff/README.md","description_en":"Python module that shows Portable Executable files in a tree view using pefile and PyQt5, as a standalone application and as a plugin for IDA Pro, Ghidra, Volatility, Rekall and minidump. It reads PE images from files, ZIP archives, Windows memory dumps and analysis databases.","description_zh":"基于 pefile 和 PyQt5、以树状视图展示 PE 文件的 Python 模块，既可作为独立应用，也可作为 IDA Pro、Ghidra、Volatility、Rekall 和 minidump 的插件使用。它能从文件、ZIP 压缩包、Windows 内存转储和分析数据库中读取 PE 映像。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"rpcview","name":"RpcView","name_zh":"RpcView Windows RPC 查看与反编译工具","url":"https://github.com/silverf0x/RpcView","evidence_url":"https://github.com/silverf0x/RpcView/blob/14d5e1a3b6cc02196dabdcf668ea341129b36be0/README.md","description_en":"Open-source Windows tool that explores and decompiles the RPC functionality present on a Microsoft system. New rpcrt4.dll runtime versions are added by extending its version table or by reversing the runtime's internal structures.","description_zh":"开源 Windows 工具，用于查看并反编译 Microsoft 系统上存在的 RPC 功能。若要支持新的 rpcrt4.dll 运行时版本，可扩充其版本表，或逆向该运行时的内部结构。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"jd-cli","name":"jd-cli","name_zh":"jd-cli 命令行 Java 反编译器","url":"https://github.com/intoolswetrust/jd-cli","evidence_url":"https://github.com/intoolswetrust/jd-cli/blob/923d00231206a36927d413621b77f984e7293b0a/README.md","description_en":"Command-line wrapper around a jd-core fork that decompiles Java class and JAR files to the console, a directory or a ZIP file, with options for line numbers, file-matching patterns and parallel processing. It also ships as a Docker image and as a Java library.","description_zh":"基于 jd-core 分支的命令行封装，可把 Java 类和 JAR 文件反编译到控制台、目录或 ZIP 文件，并提供行号、文件匹配模式和并行处理等选项。它还提供 Docker 镜像和 Java 库。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"amoco","name":"amoco","name_zh":"amoco 二进制符号分析软件包","url":"https://github.com/bdcht/amoco","evidence_url":"https://github.com/bdcht/amoco/blob/3e36c5247283a7abba57ce3c06910a7271ab1b9a/README.rst","description_en":"Python package for symbolic analysis of binaries. It combines an instruction-decoding framework for adding architectures, a symbolic algebra module that describes instruction semantics, an abstract memory and execution model, and disassembly techniques from linear sweep and recursive traversal to solver-based path-predicate exploration.","description_zh":"用于二进制符号分析的 Python 软件包。它包含便于添加新架构的指令解码框架、描述指令语义的符号代数模块、抽象内存与执行模型，以及从线性扫描、递归遍历到基于求解器的路径谓词探索等反汇编技术。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"chisel-lldb","name":"Chisel","name_zh":"Chisel iOS LLDB 调试命令集","url":"https://github.com/meta/chisel","evidence_url":"https://github.com/meta/chisel/blob/b28507a68daa10ebad609de278efe43589372649/README.md","description_en":"Collection of LLDB commands for debugging iOS apps. Commands print view and view-controller hierarchies, find views by class-name regex, show or hide views without resuming the process, mask or border views, set symbolic breakpoints on a class's method and watchpoints on instance variables, and can be extended with custom commands.","description_zh":"用于调试 iOS 应用的 LLDB 命令集。这些命令可打印视图和视图控制器层级，按类名正则查找视图，无需继续运行进程即可显示或隐藏视图，可遮罩视图或为其加边框，还能为类方法设置符号断点、为实例变量设置观察点，并支持自定义命令。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"gdbgui","name":"gdbgui","name_zh":"gdbgui gdb 浏览器前端","url":"https://github.com/cs01/gdbgui","evidence_url":"https://github.com/cs01/gdbgui/blob/773b9161729e75a6de57fb47bd084576e31de59a/README.md","description_en":"Browser-based frontend to the GNU debugger, gdb.","description_zh":"GNU 调试器 gdb 的浏览器前端。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"android-unpacker","name":"Android Unpacker","name_zh":"Android Unpacker 安卓脱壳工具集","url":"https://github.com/strazzere/android-unpacker","evidence_url":"https://github.com/strazzere/android-unpacker/blob/968ed234217edd16212738473f6493515e3d585b/README.md","description_en":"Code and slides from the Defcon 22 talk \"Android Hacker Protection Level 0\". It holds a gdb and adb script for Bangcle and SecShell, a native unpacker for APKProtect, Bangcle, LIAPP and Qihoo Packer, tweaks that hide QEMU and debuggers from APKProtect, and a Corellium-based dynamic unpacking approach with automation.","description_zh":"Defcon 22 演讲“Android Hacker Protection Level 0”的代码与幻灯片。其中包括针对 Bangcle 和 SecShell 的 gdb 与 adb 脚本，针对 APKProtect、Bangcle、LIAPP 和 Qihoo Packer 的原生脱壳工具，向 APKProtect 隐藏 QEMU 与调试器的调整，以及基于 Corellium、带自动化的动态脱壳方法。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"porosity","name":"Porosity","name_zh":"Porosity 以太坊字节码反编译器","url":"https://github.com/msuiche/porosity","evidence_url":"https://github.com/msuiche/porosity/blob/b407155d5d7d25d5e73b14fad44377f047a3b529/README.md","description_en":"Decompiler that turns Ethereum Virtual Machine bytecode into readable Solidity-syntax contracts, supported on Linux and macOS.","description_zh":"把以太坊虚拟机字节码反编译为可读的 Solidity 语法合约的工具，支持 Linux 和 macOS。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"reverseapk","name":"ReverseAPK","name_zh":"ReverseAPK 安卓应用静态分析工具","url":"https://github.com/1N3/ReverseAPK","evidence_url":"https://github.com/1N3/ReverseAPK/blob/74b33e444bd98aeb3ebc8d3d68333c3d087c3cbb/README.md","description_en":"Command-line tool that decompiles an APK to Java and Smali, lists the extracted files, and statically checks AndroidManifest.xml and the source for common vulnerabilities and behaviours such as intents, command execution, content providers, crypto references and hardcoded secrets.","description_zh":"命令行工具，可把 APK 反编译为 Java 和 Smali，列出提取的文件，并静态检查 AndroidManifest.xml 与源代码中的常见漏洞和行为，例如 Intent、命令执行、Content Provider、加密引用和硬编码密钥。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"xori","name":"Xori","name_zh":"Xori 反汇编与静态分析库","url":"https://github.com/endgameinc/xori","evidence_url":"https://github.com/endgameinc/xori/blob/d58a7427ee7928a92e32cd8fe6d1153b2aaf5568/README.md","description_en":"Automation-ready disassembly and static analysis library for shellcode and PE binaries that outputs disassembly, functions and imports as JSON. It offers a light emulation mode that enumerates all paths and a slower full emulation mode, simulated TEB and PEB structures, and FLIRT-style signatures.","description_zh":"面向自动化的反汇编与静态分析库，处理 shellcode 和 PE 二进制文件，并以 JSON 输出反汇编、函数和导入表。它提供枚举所有路径的轻量模拟模式和较慢的完整模拟模式，以及模拟的 TEB、PEB 结构和 FLIRT 风格签名。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"binglide","name":"binglide","name_zh":"binglide 文件数据类型可视化工具","url":"https://github.com/wapiflapi/binglide","evidence_url":"https://github.com/wapiflapi/binglide/blob/60168d8831279321d0f8402021d2372274252e09/README.md","description_en":"Visual reverse-engineering tool that gives a quick overview of the data types present in a file. It reads no particular format, so it also works when headers are missing or corrupted or the format is unknown.","description_zh":"可视化逆向工具，用于快速了解文件中存在的数据类型。它不依赖任何特定文件格式，因此在文件头缺失或损坏、格式未知时也能使用。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"eresi","name":"ERESI","name_zh":"ERESI 逆向工程软件接口","url":"https://github.com/thorkill/eresi","evidence_url":"https://github.com/thorkill/eresi/blob/4769c1750918742d3e18bf879acb7bbf85978d1e/README.FIRST","description_en":"Reverse Engineering Software Interface built around ELFsh, an interactive and scriptable shell for reading and modifying ELF objects, and e2dbg, an embedded ELF debugger. ELFsh analyses sections, edits headers and symbol and relocation tables, disassembles through libasm, draws control-flow graphs and injects code into ELF files.","description_zh":"逆向工程软件接口，核心是 ELFsh 和 e2dbg：前者是可交互、可脚本化的 ELF 对象读取与修改 shell，后者是嵌入式 ELF 调试器。ELFsh 可分析节，编辑文件头、符号表和重定位表，通过 libasm 反汇编，绘制控制流图，并向 ELF 文件注入代码。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"pixd","name":"pixd","name_zh":"pixd 二进制数据彩色可视化工具","url":"https://github.com/FireyFly/pixd","evidence_url":"https://github.com/FireyFly/pixd/blob/f49add4626b12b85ed20da831a6741580d0b18f6/README.md","description_en":"Terminal tool that visualises binary data like a hexdump, but draws each octet as a coloured square from a palette.","description_zh":"终端工具，以类似十六进制转储的方式可视化二进制数据，但把每个字节画成调色板中的彩色方块。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"universal-extractor-2","name":"Universal Extractor 2","name_zh":"Universal Extractor 2 通用文件解包工具","url":"https://github.com/Bioruebe/UniExtract2","evidence_url":"https://github.com/Bioruebe/UniExtract2/blob/9719ac988421e48276420e2f33e09087cfbacf8d/README.md","description_en":"Unofficial, extended continuation of Universal Extractor that unpacks files from standard archives, application installers, disk images and game archives. Version 2 adds batch mode, a scan-only mode that detects a file's type, password lists and silent mode.","description_zh":"Universal Extractor 的非官方扩展延续版本，可从标准压缩包、应用安装程序、磁盘映像和游戏归档中解包文件。第 2 版增加了批处理模式、只检测文件类型的扫描模式、密码列表和静默模式。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-11-06"},{"id":"ellekit","name":"ElleKit","name_zh":"ElleKit arm64 函数钩子工具包","url":"https://github.com/tealbathingsuit/ellekit","evidence_url":"https://github.com/tealbathingsuit/ellekit/blob/1017a0d09606ea49ba8bc4d6cccc530d372e640e/README.md","description_en":"Function hooking toolkit for arm64 XNU devices: a C function hooker that patches memory pages directly, an Objective-C function hooker, an arm64 assembler, JIT inline assembly for Swift and a reimplementation of the Substrate and libhooker APIs. The README lists the Dopamine, palera1n and meowbrek2 jailbreaks as users.","description_zh":"面向 arm64 XNU 设备的函数钩子工具包：包括直接修补内存页的 C 函数钩子、Objective-C 函数钩子、arm64 汇编器、Swift JIT 内联汇编，以及 Substrate 和 libhooker API 的重新实现。README 列出 Dopamine、palera1n 和 meowbrek2 越狱工具为其使用者。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"xhook","name":"xHook","name_zh":"xHook Android PLT 钩子库","url":"https://github.com/iqiyi/xHook","evidence_url":"https://github.com/iqiyi/xHook/blob/391d0c4103626bf39d54a1d9c7a10965c82ff8d2/README.md","description_en":"PLT hook library for Android native ELF executables and shared libraries. It handles ELF HASH and GNU HASH symbols and SLEB128-encoded relocations, selects targets with regular expressions, and needs no root or system permissions.","description_zh":"面向 Android 原生 ELF 可执行文件和共享库的 PLT 钩子库。它支持 ELF HASH 和 GNU HASH 符号以及 SLEB128 编码的重定位信息，可用正则表达式选择目标，无需 root 或系统权限。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"epic-android-hook","name":"Epic","name_zh":"Epic Android ART 方法钩子框架","url":"https://github.com/tiann/epic","evidence_url":"https://github.com/tiann/epic/blob/c67d0d3e3769c19119465784a579c659dd88c4ce/README.md","description_en":"Continuation of Dexposed on ART: a runtime method-hooking framework that loads into an app and can hook both the app's own code and Android framework code running in its process. Stated uses include instrumentation and security audits.","description_zh":"Dexposed 在 ART 上的延续：运行时方法钩子框架，加载到应用内后既能钩住应用自身代码，也能钩住在其进程中运行的 Android 框架代码。其说明的用途包括插桩和安全审计。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"procdump-linux","name":"ProcDump for Linux and macOS","name_zh":"ProcDump Linux 与 macOS 版进程转储工具","url":"https://github.com/microsoft/ProcDump-Linux","evidence_url":"https://github.com/microsoft/ProcDump-Linux/blob/2f83148dbc62da574a953a5eaaeb38b499847cd0/README.md","description_en":"Linux and macOS reimagining of the Sysinternals ProcDump tool that writes process dumps in response to performance, runtime, signal and resource-tracking triggers, including native dumps through a Rust ELF writer and managed dumps through .NET diagnostics IPC.","description_zh":"Sysinternals ProcDump 工具在 Linux 和 macOS 上的重新实现，可按性能、运行时、信号和资源跟踪触发条件写出进程转储，包括通过 Rust ELF 写入器生成的原生转储，以及通过 .NET 诊断 IPC 生成的托管转储。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"fishhook","name":"fishhook","name_zh":"fishhook Mach-O 符号重绑定库","url":"https://github.com/meta/fishhook","evidence_url":"https://github.com/meta/fishhook/blob/aadc161ac3b80db07a9908851839a17ba63a9eb1/README.md","description_en":"Small library that dynamically rebinds symbols in Mach-O binaries running on iOS, on device and in the simulator, by updating the lazy and non-lazy symbol pointers that dyld uses.","description_zh":"小型库，可动态重新绑定运行在 iOS（真机和模拟器）上的 Mach-O 二进制文件中的符号，方法是更新 dyld 使用的惰性和非惰性符号指针。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"pcode2code","name":"pcode2code","name_zh":"pcode2code VBA p-code 反编译器","url":"https://github.com/Big5-sec/pcode2code","evidence_url":"https://github.com/Big5-sec/pcode2code/blob/65ae9832884bb0ebba16f96df257e387d427cd72/README.md","description_en":"VBA p-code decompiler based on pcodedmp, written for Office documents whose macro source has been stomped to leave only bytecode. It takes a document or a previously saved pcodedmp dump and also works as a Python module.","description_zh":"基于 pcodedmp 的 VBA p-code 反编译器，用于处理宏源代码已被抹除、只留下字节码的 Office 文档。它接受文档或先前保存的 pcodedmp 转储，也可作为 Python 模块使用。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"weeping-of-the-empire-case","name":"Weeping of the Empire: statically recompiling Tears of the Kingdom for Windows","name_zh":"Weeping of the Empire：将《塞尔达传说 王国之泪》静态重编译至 Windows","url":"https://github.com/daniel-madrid-07/weeping-of-the-empire","evidence_url":"https://github.com/daniel-madrid-07/weeping-of-the-empire/blob/cfb47bc13b25fc686e0ef2616b451662b62c2b31/README.md","description_en":"Weeping of the Empire builds a native Windows port of The Legend of Zelda: Tears of the Kingdom from the user's Switch game dump. It recompiles ARM64 code ahead of time to x86-64, supplies Switch services through a host runtime and renders through Vulkan. The engine documentation credits totk-recomp as the starting point and identifies the added Windows port, renderer, controls and menus.","description_zh":"Weeping of the Empire 从用户自己的 Switch《塞尔达传说 王国之泪》转储构建原生 Windows 版本。它预先将 ARM64 代码重编译为 x86-64，以宿主运行时提供 Switch 系统服务，并通过 Vulkan 渲染。引擎文档说明其以 totk-recomp 为起点，另行开发了 Windows 移植、渲染、控制和菜单。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"exoproc","name":"Exoproc","name_zh":"Exoproc Windows 进程插桩与智能体 MCP 接口","url":"https://github.com/w0ldan/exoproc","evidence_url":"https://github.com/w0ldan/exoproc/blob/e1d0710f1ec89e6e987cf6991b3e5e09c6647711/README.md","description_en":"Exoproc exposes Windows x64 process inspection and instrumentation to agents through a CLI and MCP server. It enumerates processes, reads and scans memory, installs function detours, redirects thread contexts and compiles C snippets for execution in a target process.","description_zh":"Exoproc 通过命令行和 MCP 服务向智能体开放 Windows x64 进程检查与插桩。它可枚举进程、读取和扫描内存、安装函数钩子、重定向线程上下文，并编译 C 代码片段供目标进程执行。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-11-06"},{"id":"simcity-3000-gta-mode-case","name":"GTA Mode: reverse-engineering SimCity 3000 Unlimited for a native plugin","name_zh":"GTA Mode：逆向 SimCity 3000 Unlimited 并开发原生插件","url":"https://github.com/DenisSergeevitch/simcity3000-gta-mode","evidence_url":"https://github.com/DenisSergeevitch/simcity3000-gta-mode/blob/bb7fcb2106acf51a2bf195de2bab103cb16ff55b/README.md","description_en":"GTA Mode is a native plugin that adds direct control of spawned citizens and cars to SimCity 3000 Unlimited. It uses findings from Ghidra analysis of the game's binaries, GZCOM plugin loading, in-memory city structures and sprite archives. The C plugin runs in the original game, reads city data from its memory and decodes art from the user's installation; MODLOG.md records addresses, formats and dead ends.","description_zh":"GTA Mode 是为《SimCity 3000 Unlimited》加入可操控行人和车辆的原生插件，这些行人和车辆由插件生成。项目利用 Ghidra 对游戏二进制、GZCOM 插件加载机制、内存中的城市结构和精灵图档案的分析成果。C 插件在原游戏中运行，从游戏内存读取城市数据，并从用户安装的游戏文件解码图像；MODLOG.md 记录了地址、格式和未成功的尝试。","kind":"case-study","category":"game-analysis","group":"learn","relationship":"learning","targets":["binary","game"],"verified_at":"2026-11-06"},{"id":"fh2mp-case","name":"FH2MP: reconstructed Forza Horizon 2 online services","name_zh":"FH2MP：重建《Forza Horizon 2》在线服务","url":"https://github.com/Charelene/FH2MP","evidence_url":"https://github.com/Charelene/FH2MP/blob/150a4030b7560dee5349e0f4713427523042dfb6/README.md","description_en":"FH2MP restores Forza Horizon 2 multiplayer with a replacement server based on protocol behavior recovered from the Xbox One game client. An in-game shim redirects sockets and web-service calls, while Python and Go servers handle lobbies, worlds and online features; a launcher manages setup and updates.","description_zh":"FH2MP 根据 Xbox One 版《Forza Horizon 2》客户端中恢复的协议行为，搭建替代服务器以恢复多人游戏。游戏内 shim 重定向网络连接和 Web 服务请求；Python 与 Go 服务器处理大厅、世界及在线功能，启动器负责安装与更新。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game","protocol"],"verified_at":"2026-11-06"},{"id":"opendevicedb","name":"OpenDeviceDB","name_zh":"OpenDeviceDB 设备逆向资料目录","url":"https://github.com/opendevicedb/opendevicedb","evidence_url":"https://github.com/opendevicedb/opendevicedb/blob/0db6a1f7f88bcabb069d951fa59b603aaf4b49bf/README.md","description_en":"OpenDeviceDB indexes devices with existing firmware or protocol reverse-engineering work and links back to source projects. Its website lists installation routes and remaining vendor dependencies, while importers aggregate existing databases and an MCP server lets agents query device records.","description_zh":"OpenDeviceDB 索引已有固件或协议逆向成果的设备，并链接原始项目。网站列出开放固件的安装途径及仍依赖厂商的部分；导入器汇集其他数据库，MCP 服务器供智能体查询设备记录。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["firmware","protocol"],"verified_at":"2026-11-06"},{"id":"esp-idf-injection-ng","name":"esp-idf-injection-ng","name_zh":"esp-idf-injection-ng ESP-IDF 帧发送限制分析","url":"https://github.com/mahdamin/esp-idf-injection-ng","evidence_url":"https://github.com/mahdamin/esp-idf-injection-ng/blob/697bd7f062713cd37874d49d2b2da3bd48b9b293/README.md","description_en":"esp-idf-injection-ng documents an investigation of ESP-IDF's compiled libnet80211.a frame-type check. The author traces why symbol overrides fail in v5 and later, then supplies an objcopy patch, demonstration firmware and captures for transmitting additional 802.11 management frames through esp_wifi_80211_tx.","description_zh":"esp-idf-injection-ng 记录了对 ESP-IDF 已编译 libnet80211.a 中帧类型检查逻辑的研究。作者追查旧版符号覆盖方法在 v5 以后失效的原因，并提供 objcopy 补丁、演示固件和抓包资料，用 esp_wifi_80211_tx 发送额外的 802.11 管理帧。","kind":"research","category":"native-analysis","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-11-06"},{"id":"cursed-lands-case","name":"Cursed Lands: a Godot engine for Evil Islands and Lost in Astral","name_zh":"Cursed Lands：用 Godot 重建《Evil Islands》与《Lost in Astral》引擎","url":"https://github.com/TheWWWorm/CursedLands","evidence_url":"https://github.com/TheWWWorm/CursedLands/blob/24624cee85ae7bfd380739ef9d32e6ed842c6951/README.md","description_en":"Cursed Lands reimplements the engine for Evil Islands and Lost in Astral in Godot, reading maps, models, audio, scripts and tables from the player's own game copy. Its native rendering, combat, AI, scripting and interface systems follow the original game's rules, with releases for desktop, Android and browsers.","description_zh":"Cursed Lands 使用 Godot 重建《Evil Islands》及扩展《Lost in Astral》的引擎，从玩家自备的游戏文件读取地图、模型、音频、脚本和数据表。项目重新编写渲染、战斗、AI、脚本及界面系统，提供桌面、Android 和浏览器版本。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"pkg-to-anyps5","name":"pkg-to-anyps5","name_zh":"pkg-to-anyps5 PS5 调试包提取工具","url":"https://github.com/awake-devel/pkg-to-anyps5","evidence_url":"https://github.com/awake-devel/pkg-to-anyps5/blob/2e9b12267840f9777f8d825335c4b4938160d9c4/README.md","description_en":"pkg-to-anyps5 extracts PS5 debug game packages or game folders into the layout expected by the AnyPS5 relinker. It parses FIH, PFS and NAPS structures, decodes supported Kraken blocks, and unwraps fake-signed SELF executables and modules into ELF files.","description_zh":"pkg-to-anyps5 将 PS5 调试版游戏包或已提取的游戏目录整理为 AnyPS5 重链接器所需的结构。它解析 FIH、PFS 和 NAPS，解码支持的 Kraken 块，并把假签名 SELF 可执行文件及模块还原为 ELF。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"questpad-case","name":"QuestPad: a USB gamepad from the Quest Touch radio protocol","name_zh":"QuestPad：利用 Quest Touch 无线协议构建 USB 手柄","url":"https://github.com/Jakey-Jakey/questpad","evidence_url":"https://github.com/Jakey-Jakey/questpad/blob/0a96a24c090062473bf5e2ae12a30301fea792fa/PROTOCOL.md","description_en":"QuestPad implements the Quest Touch controllers' private 2.4 GHz radio protocol on nRF52840 firmware so a computer can use them as a USB gamepad. Its protocol reference documents pairing, AES-CCM encrypted controller packets, 2 ms link frames and input data; the firmware exposes generic gamepad, DS4 and XInput modes.","description_zh":"QuestPad 在 nRF52840 固件中实现 Quest Touch 手柄的私有 2.4 GHz 无线协议，让电脑将手柄作为 USB 游戏控制器使用。协议文档记录了配对、AES-CCM 加密数据包、2 毫秒链路帧和输入数据；固件提供通用手柄、DS4 与 XInput 模式。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"pmca-re-reloaded","name":"PMCA-RE RELOADED","name_zh":"PMCA-RE RELOADED 索尼相机分析与管理工具","url":"https://github.com/masterflai/pmca-re-reloaded","evidence_url":"https://github.com/masterflai/pmca-re-reloaded/blob/a919b823151bbe235de8e16ce3d2a9ec1d50d584/README.md","description_en":"PMCA-RE RELOADED is a Rust desktop and CLI toolkit for Sony cameras that includes experimental analysis of where menu settings reside in camera settings memory. It also parses firmware files, backup images and usage logs offline, and provides USB access to camera information, apps, firmware updates and settings. Supported operations depend on the camera generation.","description_zh":"PMCA-RE RELOADED 是面向 Sony 相机的 Rust 桌面与命令行工具，实验性功能可分析菜单设置在相机设置存储区中的位置。它还可离线解析固件文件、备份镜像和使用日志，并通过 USB 读取相机信息、管理应用、固件和设置；可用功能随相机代际而异。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"nfs-mw-case","name":"nfs-mw: a Rust reconstruction of Need for Speed: Most Wanted","name_zh":"nfs-mw：用 Rust 重建《极品飞车：最高通缉》","url":"https://github.com/47PADO47/nfs-mw","evidence_url":"https://github.com/47PADO47/nfs-mw/blob/8d0b3c1906003c00f0416887cbd21ca3492e02d5/README.md","description_en":"nfs-mw reconstructs Need for Speed: Most Wanted 2005 PC v1.3 in Rust using data read from the user's installation. Its format readers decode bChunk, JDLZ, HUFF, cars, textures, and the streamed city; the current runtime provides viewers, driving, menus, and free roam.","description_zh":"nfs-mw 用 Rust 重建 2005 年 PC 版《极品飞车：最高通缉》v1.3，并从用户本机安装目录读取数据。项目解析 bChunk、JDLZ、HUFF、车辆、纹理和分区加载的城市数据；目前提供查看器、驾驶、菜单与自由漫游。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"osiris-onkyo-receiver-case","name":"OSIRIS: replacing Onkyo receiver firmware through MCU protocol research","name_zh":"OSIRIS：基于 MCU 协议研究替换 Onkyo 功放固件","url":"https://github.com/ubis/OSIRIS","evidence_url":"https://github.com/ubis/OSIRIS/blob/8515cd884c55f71f1bda35e0efc1586563dfaf6a/docs/mcu-protocol.md","description_en":"OSIRIS replaces the DSP-board software of Onkyo TX-NR515 and TX-NR717 receivers with its own boot loader, Linux services and DSP code. The project documents the SPI exchange between the main MCU and DSP board, including 1032-byte transfers, frame structure and command meanings recovered from stock firmware and logs.","description_zh":"OSIRIS 以自制引导程序、Linux 服务和 DSP 代码替换 Onkyo TX-NR515、TX-NR717 功放的 DSP 板软件。项目依据原厂固件和日志整理主 MCU 与 DSP 板之间的 SPI 通信，记录 1032 字节传输、帧格式及命令含义。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","protocol"],"verified_at":"2026-11-06"},{"id":"stadiacast-case","name":"Stadiacast: reconstructing the Stadia Controller's Wi-Fi service","name_zh":"Stadiacast：重建 Stadia 手柄的 Wi-Fi 服务","url":"https://github.com/jkfran/stadiacast","evidence_url":"https://github.com/jkfran/stadiacast/blob/61e8aee978a8514a5c1aaa39fcaae1bb5dfcde39/docs/protocol.md","description_en":"Stadiacast recreates the network service used by the Stadia Controller's Wi-Fi firmware so the controller can connect to a local computer. The receiver answers boot and discovery requests, completes WebRTC and DTLS sessions, decodes input and sends rumble commands. Protocol notes record findings from firmware reading and live controller runs, with protobuf schemas and receiver code in the repository.","description_zh":"Stadiacast 重建 Stadia 手柄 Wi-Fi 固件所依赖的网络服务，让手柄连接本地电脑。接收端响应启动和发现请求，完成 WebRTC、DTLS 会话，解码按键输入并发送震动命令。协议文档记录了固件阅读和真机交互所得的结果，仓库还提供 protobuf 结构与服务端代码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"rust-deobf","name":"rust-deobf","name_zh":"rust-deobf Rust 二进制去混淆工具","url":"https://github.com/VAHPEM/rust-deobf","evidence_url":"https://github.com/VAHPEM/rust-deobf/blob/04a9c4a371cb77635e2eed2c36157af36e058961/README.md","description_en":"rust-deobf analyzes compiled, mainly Rust, ELF, PE and Mach-O binaries to recover hidden strings and related artifacts. It combines static call-site analysis with Unicorn function emulation, identifies Rust metadata and library functions, and offers unpacking and Ghidra annotations. CLI and MCP interfaces expose the core analysis; deeper control-flow and virtualization modules have separate licensing.","description_zh":"rust-deobf 分析以 Rust 为主的 ELF、PE 和 Mach-O 二进制文件，恢复隐藏字符串及相关信息。工具结合静态调用点分析与 Unicorn 函数仿真，还可识别 Rust 元数据和库函数、处理打包样本并为 Ghidra 添加注释。核心功能提供命令行和 MCP 接口；更深入的控制流及虚拟化模块另有许可。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"thisfirmwaredoesnotexist","name":"ThisFirmwareDoesNotExist","name_zh":"ThisFirmwareDoesNotExist MicroFreak 固件分析与补丁工具","url":"https://github.com/ThisFreakDoesntExist/ThisFirmwareDoesNotExist","evidence_url":"https://github.com/ThisFreakDoesntExist/ThisFirmwareDoesNotExist/blob/a97f78a84ac1fcf15f92b435499ce009ba0836ea/README.md","description_en":"ThisFirmwareDoesNotExist maps Arturia MicroFreak firmware 5.0.0.2084 and provides freakpatch to modify a user's official update file. Its notes cover the update format and firmware subsystems, while Ghidra scripts and assembly sources support the documented patch locations.","description_zh":"ThisFirmwareDoesNotExist 分析 Arturia MicroFreak 5.0.0.2084 固件，并用 freakpatch 修改用户自备的官方更新文件。文档记录更新格式与固件子系统，Ghidra 脚本和汇编源码对应具体补丁位置。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"re-workstation","name":"RE-Workstation","name_zh":"RE-Workstation 逆向分析知识库","url":"https://github.com/SUNYT772/RE-Workstation","evidence_url":"https://github.com/SUNYT772/RE-Workstation/blob/08af66cba3f0451be6b7f065b5b875fd3ef77fb8/README.md","description_en":"RE-Workstation is a Chinese reference library for reverse-engineering workflows and related security research. Its topic pages cover native binaries, APKs, firmware, JavaScript, patch diffing and malware analysis, with indexes, evidence templates and pattern references for locating relevant methods.","description_zh":"RE-Workstation 是中文逆向分析与相关安全研究知识库。专题页面涵盖原生二进制、APK、固件、JavaScript、补丁差分和恶意代码分析，并提供索引、证据模板及特征参考，帮助按任务查找方法。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app","binary","firmware","website"],"verified_at":"2026-11-06"},{"id":"bf-private-server-case","name":"bf-private-server: a Brave Frontier revival server","name_zh":"bf-private-server：《Brave Frontier》服务端重建","url":"https://github.com/joppe2001/bf-private-server","evidence_url":"https://github.com/joppe2001/bf-private-server/blob/f9d0b5a324ecb517e257d8d0c39413840caa851b/README.md","description_en":"bf-private-server recreates a self-hosted server for Brave Frontier client version 2.19.6. Its C++23 service answers the game's HTTP requests, stores saves in SQLite and works with CDN workers and a patcher for the user's Android client; request tables and boot-flow notes document the protocol investigation. The server builds on an earlier emulator fork.","description_zh":"bf-private-server 为《Brave Frontier》2.19.6 客户端重建可自行部署的服务端。C++23 服务处理游戏 HTTP 请求并以 SQLite 保存进度，配套 CDN Worker 和自有 Android 客户端补丁工具；仓库还记录请求表和启动流程。服务端以较早的模拟器分支为基础。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game","protocol"],"verified_at":"2026-11-06"},{"id":"clickwill-case","name":"Clickwill: reconstructing iPod library database editing","name_zh":"Clickwill：重建 iPod 音乐库数据库编辑功能","url":"https://github.com/jakubwarzecha00/clickwill","evidence_url":"https://github.com/jakubwarzecha00/clickwill/blob/194b138f0cf3aa0239e5db532814d0bce5438660/docs/byte-map.md","description_en":"Clickwill reconstructs direct editing of iPod classic and iPod nano music libraries in a Swift Mac app. It reads and writes iTunesDB and ArtworkDB on the device, preserves unknown record bytes, handles hash58 signatures and publishes a byte map that distinguishes measured fields from uncertain ones.","description_zh":"Clickwill 以 Swift Mac 应用重建 iPod classic 和 iPod nano 音乐库的直接编辑功能。它读写设备上的 iTunesDB 与 ArtworkDB，保留未知记录字节，处理 hash58 签名，并发布区分实测字段与待确认字段的字节映射。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-11-06"},{"id":"virtual-mpc-sample-case","name":"Virtual MPC Sample: rehosting Akai MPC Sample firmware in QEMU","name_zh":"Virtual MPC Sample：在 QEMU 中运行 Akai MPC Sample 固件","url":"https://github.com/orrpunk-art/virtual-mpc-sample","evidence_url":"https://github.com/orrpunk-art/virtual-mpc-sample/blob/15f732c71fdd722c924590b9cdec2429f7a1ec2b/README.md","description_en":"Virtual MPC Sample rehosts Akai MPC Sample 1.3.0.12 firmware in QEMU using a custom lab kernel and a browser panel for the device controls. The repository documents firmware and device architecture, emulates the panel's UART communication and provides a shell, tracing and mod testing against the user's own firmware files.","description_zh":"Virtual MPC Sample 使用定制实验内核和浏览器控制面板，在 QEMU 中运行 Akai MPC Sample 1.3.0.12 固件。仓库记录固件及设备架构，模拟面板 UART 通信，并可对用户自备固件进行 shell 检查、跟踪和改装测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","protocol"],"verified_at":"2026-11-06"},{"id":"openjooki-jooki2-case","name":"OpenJooki: replacing the Jooki 2 software and recovery path","name_zh":"OpenJooki：替换 Jooki 2 软件与恢复流程","url":"https://github.com/Guillain-RDCDE/OpenJooki","evidence_url":"https://github.com/Guillain-RDCDE/OpenJooki/blob/8d302eb5011cd24219f0130b5786c6545989f9fb/docs/04-architecture.md","description_en":"OpenJooki replaces the Jooki 2 music speaker's embedded Linux core and provides phone-based control, updates and SD-card recovery. Its technical notes map the device's Ingenic Linux and ESP32 split, storage partitions, Mender update slots and recovery behavior, while the repository contains the replacement Lua services and installer tooling.","description_zh":"OpenJooki 替换 Jooki 2 音乐音箱的嵌入式 Linux 核心，提供手机控制、更新与 SD 卡恢复。技术文档记录 Ingenic Linux 与 ESP32 的分工、存储分区、Mender 更新槽及恢复机制；仓库包含替代 Lua 服务和安装工具。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"intel-ma","name":"intel_ma","name_zh":"intel_ma：管理固件分析与修改工具","url":"https://github.com/seuros/intel_ma","evidence_url":"https://github.com/seuros/intel_ma/blob/372e1a3d5db03a1920a5cf9201b68cd7947cd008/README.md","description_en":"intel_ma inspects PC management firmware in ME/TXE/CSME region images and full SPI dumps. Its Rust library and CLI parse partition tables, AMD PSP directories, UEFI firmware volumes and FIT records, and report Boot Guard, BIOS Guard and descriptor locks. It can also remove selected Intel ME components and set documented disable flags in an output image.","description_zh":"intel_ma 检查 ME/TXE/CSME 区域镜像和完整 SPI 转储中的 PC 管理固件。其 Rust 库与命令行工具解析分区表、AMD PSP 目录、UEFI 固件卷和 FIT 记录，并报告 Boot Guard、BIOS Guard 及描述符锁定信息。它还可从输出镜像中移除部分 Intel ME 组件并设置禁用标志。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"breakinggood","name":"breakinggood","name_zh":"breakinggood 网站采集与重建工具","url":"https://github.com/eklavya2201/breakinggood","evidence_url":"https://github.com/eklavya2201/breakinggood/blob/f9f4dc36a272fa93493f096efaa87e9b4ccc17d3/README.md","description_en":"breakinggood captures a website's screenshots, cleaned DOM, computed design values, images, and XHR/fetch responses, then generates a Vite, React, and Tailwind rebuild with a mock API replaying observed JSON. Its CLI and MCP server expose site capture alongside a separate Git repository setup workflow.","description_zh":"breakinggood 采集网站截图、清理后的 DOM、计算得到的设计参数、图片和 XHR/fetch 响应，再生成 Vite、React、Tailwind 重建项目，并用模拟 API 重放观察到的 JSON。命令行和 MCP 服务器也提供独立的 Git 仓库准备功能。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-11-06"},{"id":"openlf2-case","name":"OpenLF2: a Little Fighter 2 engine reimplementation","name_zh":"OpenLF2：Little Fighter 2 引擎重实现","url":"https://github.com/OpenLF2/OpenLF2","evidence_url":"https://github.com/OpenLF2/OpenLF2/blob/6942db7cfaddf2e65eb45e4a4d4632120dc968f7/README.md","description_en":"OpenLF2 reimplements Little Fighter 2 v2.0a as a playable C++ and Lua engine. It loads resources from the original game installer and provides local modes, replays, mods and network matches between OpenLF2 players. The author states that gameplay compatibility is still being refined.","description_zh":"OpenLF2 用 C++ 和 Lua 重实现了可玩的《Little Fighter 2》v2.0a 引擎。它从原版游戏安装程序读取资源，支持本地模式、回放、模组及 OpenLF2 玩家之间的联机对战。作者表示仍在改进与原版的玩法兼容性。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"stickwalker-case","name":"Stickwalker: porting Pokéwalker firmware to the Stick S3","name_zh":"Stickwalker：将 Pokéwalker 固件移植到 Stick S3","url":"https://github.com/lumirth/stickwalker","evidence_url":"https://github.com/lumirth/stickwalker/blob/3e6634d19201d2f58507af2d0c479a41b79ad533/README.md","description_en":"Stickwalker ports a matching reconstruction of Pokéwalker firmware to the M5Stack Stick S3. The repository includes firmware source, build tooling and placeholder artwork; users can build with artwork extracted from their own ROM, and a BPV10NF photodiode supplies infrared reception.","description_zh":"Stickwalker 将 Pokéwalker 的匹配固件重建成果移植到 M5Stack Stick S3。仓库提供固件源码、构建工具和占位图像；用户可从自有 ROM 提取原版图像参与构建，并通过 BPV10NF 光电二极管接收红外信号。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"qemu-rtd2841","name":"qemu-rtd2841","name_zh":"qemu-rtd2841 Realtek RTD2841 芯片组模拟器","url":"https://github.com/rubenthampy890-del/qemu-rtd2841","evidence_url":"https://github.com/rubenthampy890-del/qemu-rtd2841/blob/8d0c64f5a25153c0e44621dc84dd2de0fbf7616b/README.md","description_en":"qemu-rtd2841 adds a Realtek RTD2841/RTK284x TV machine model to QEMU for bare-metal diagnostics and local firmware experiments. Its board profile models AArch32 Cortex-A53 cores, GICv2, timers, SDHCI, Ethernet, UART, and a framebuffer, with diagnostic assembly and a staged test runner.","description_zh":"qemu-rtd2841 为 QEMU 添加 Realtek RTD2841/RTK284x 电视硬件模型，用于裸机诊断和本地固件实验。其板级配置涵盖 AArch32 Cortex-A53、GICv2、定时器、SDHCI、以太网、UART 和帧缓冲，并附汇编诊断程序及分层测试脚本。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"os-xgs-npu-case","name":"os-xgs-npu: reconstructing Sophos XGS coprocessor interfaces","name_zh":"os-xgs-npu：重建 Sophos XGS 协处理器接口","url":"https://github.com/AbdelmonemAwad/os-xgs-npu","evidence_url":"https://github.com/AbdelmonemAwad/os-xgs-npu/blob/d4695512cb4491859a3044a34fc25b9a3ed1e8eb/README.md","description_en":"os-xgs-npu reconstructs interfaces to Sophos XGS appliance coprocessors through FreeBSD kernel modules and an OPNsense plugin. The work documents undocumented registers, PCIe device families and measured coprocessor behavior to expose front ports and offload firewall flows and IPsec associations.","description_zh":"os-xgs-npu 通过 FreeBSD 内核模块和 OPNsense 插件重建 Sophos XGS 设备的协处理器接口。项目记录未公开寄存器、PCIe 设备系列及实测行为，用于开放前面板端口并卸载防火墙连接和 IPsec 关联。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"spark-mail-linux-case","name":"Spark Mail: rehosting the Windows desktop app on Linux with Wine shims","name_zh":"Spark Mail：借助 Wine 兼容层在 Linux 上运行 Windows 桌面应用","url":"https://github.com/kyryl-bogach/spark-mail-linux","evidence_url":"https://github.com/kyryl-bogach/spark-mail-linux/blob/36e74b20b8a8b7f74ae2d386cbf563fddb018276/README.md","description_en":"spark-mail-linux rehosts the Windows Spark Mail desktop app on Linux with Wine, two compatibility DLL shims and launcher scripts. The project documents application startup, browser authentication, notifications, clipboard and file-opening behavior, then patches specific DLL imports and bridges those functions to the Linux desktop.","description_zh":"spark-mail-linux 通过 Wine、两个兼容 DLL 和启动脚本在 Linux 上运行 Windows 版 Spark Mail。项目记录应用启动、浏览器登录、通知、剪贴板及文件打开行为，并通过修改 DLL 导入项和桌面桥接处理这些问题。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-11-06"},{"id":"libremp-easymp-case","name":"LibreMP: an Epson EasyMP screen caster from packet-capture research","name_zh":"LibreMP：基于抓包研究的 Epson EasyMP 投屏客户端","url":"https://github.com/MuazTPM-YT/libre-mp","evidence_url":"https://github.com/MuazTPM-YT/libre-mp/blob/c0fe797ee8697fd75dbf24fc4eadf041ba8e876e/docs/NOTES.md","description_en":"LibreMP casts desktop screens to Epson EasyMP projectors using a protocol reconstructed from Windows client packet captures. Its Rust core handles registration and login messages, projector QR decoding, JPEG tile streaming and changed-region updates; a CLI and Tauri interface use the same core. The project documents control on TCP 3620 and video on TCP 3621.","description_zh":"LibreMP 根据 Windows 客户端抓包还原 Epson EasyMP 协议，实现桌面向投影仪投屏。Rust 核心处理注册与登录消息、投影仪二维码解码、JPEG 分块传输及画面变化区域更新；命令行和 Tauri 界面共用该核心。文档记录控制通道使用 TCP 3620，视频通道使用 TCP 3621。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"cfg-visualizer","name":"CFG Visualizer","name_zh":"CFG Visualizer 三维控制流图查看工具","url":"https://github.com/zhameersheraz/cfg-visualizer","evidence_url":"https://github.com/zhameersheraz/cfg-visualizer/blob/76a84f0118f719e86458d2b755fefd1820fd4a40/README.md","description_en":"CFG Visualizer extracts function control-flow graphs from ELF, PE and Mach-O binaries with radare2 and presents them in an interactive 3D browser view. Its FastAPI backend returns graph JSON, while the frontend shows branch edges and node disassembly.","description_zh":"CFG Visualizer 借助 radare2 从 ELF、PE 和 Mach-O 文件提取函数控制流图，在浏览器中交互式显示三维节点、分支边及反汇编。FastAPI 后端负责分析并输出图结构 JSON。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"atlantis-native-case","name":"Atlantis Native: porting the Atlantis and Atlantis II engines to Rust","name_zh":"Atlantis Native：将 Atlantis 与 Atlantis II 引擎移植到 Rust","url":"https://github.com/ripleyXLR8/atlantis-native","evidence_url":"https://github.com/ripleyXLR8/atlantis-native/blob/6c4820c778597297c9c0bbfe5f2a13b0fe9989f3/README.md","description_en":"Atlantis Native ports the reverse-engineered CryOmni3D Atlantis engine to Rust for Atlantis: The Lost Tales and Atlantis II. It reads files from the user's own game copies and runs their scripts, panoramas, cinematics and puzzles on desktop systems and in browsers, with optional display and bug fixes.","description_zh":"Atlantis Native 把经逆向重建的 CryOmni3D Atlantis 引擎移植到 Rust，支持 Atlantis: The Lost Tales 与 Atlantis II。它读取用户自备游戏文件，在桌面系统和浏览器中运行原有脚本、全景画面、过场动画及谜题，并提供可选的显示改进和错误修复。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"lc75826-sony-cdx-a250-case","name":"Sony CDX-A250: reconstructing the LCD panel interface","name_zh":"Sony CDX-A250：还原 LCD 面板接口","url":"https://github.com/emsyscode/lc75826-sony-cdx-a250","evidence_url":"https://github.com/emsyscode/lc75826-sony-cdx-a250/blob/8f830424e2997a4879b550980533f6d516cfc67d/README.md","description_en":"Sony CDX-A250 LCD Panel reconstructs the serial control needed to drive the radio's detachable display independently through its LC75826W driver. Wiring notes, CCB transfer documentation, and an Arduino sketch cover display-data groups, control bits, test patterns, and experimental segment mapping.","description_zh":"Sony CDX-A250 LCD Panel 还原通过 LC75826W 驱动器独立控制汽车收音机可拆卸显示屏所需的串行接口。接线说明、CCB 传输文档和 Arduino 程序涵盖显示数据组、控制位、测试图案及实验性段位映射。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"apkscope","name":"apkscope","name_zh":"apkscope Android 应用反编译分析工具","url":"https://github.com/suffixing/apkscope","evidence_url":"https://github.com/suffixing/apkscope/blob/e224d4feecfb4e2a631956a239aa752b524b2609/README.md","description_en":"apkscope inspects Android application packages through a Rust viewer, CLI, and MCP server. It decompiles DEX classes into Java, searches code and references, reads manifests and resources, scans URLs and secrets including native libraries, and can export or modify packages.","description_zh":"apkscope 通过 Rust 编写的查看器、命令行和 MCP 服务器分析 Android 应用包。它把 DEX 类反编译为 Java，检索代码与引用，读取清单和资源，扫描包括原生库在内的 URL 与密钥，并支持导出或修改包。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-11-06"},{"id":"macropad-usb-protocol-case","name":"MacroPad: reconstructing a USB macropad configuration protocol","name_zh":"MacroPad：重建 USB 宏键盘配置协议","url":"https://github.com/Probler-Yt/MacroPad","evidence_url":"https://github.com/Probler-Yt/MacroPad/blob/2b75543c74727427ea4f3cc1d3c720fbd56fc438/docs/protocol.md","description_en":"MacroPad reconstructs the USB HID configuration exchange of a 12-key, two-knob macropad identified as 1189:8840 and implements it in a Linux GUI. The author documents capturing MINI_KEYBOARD.exe traffic with usbmon, decoding configuration and commit reports, and replaying captured packets in tests.","description_zh":"MacroPad 重建了 USB ID 为 1189:8840 的 12 键双旋钮宏键盘的 HID 配置交互，并提供 Linux 图形客户端。作者记录了用 usbmon 抓取 MINI_KEYBOARD.exe 流量、解析配置与提交报告，以及在测试中重放抓包数据的过程。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"monix-audient-id-case","name":"Monix: reconstructing Audient iD USB mixer control on Linux","name_zh":"Monix：在 Linux 上重建 Audient iD USB 混音器控制","url":"https://github.com/sKuhLight/monix","evidence_url":"https://github.com/sKuhLight/monix/blob/121a1f5aeee197a6b1fa5bdd78db20840111db21/docs/PROTOCOL.md","description_en":"Monix implements Linux mixer control for Audient iD USB audio interfaces through a companion kernel module, protocol library and GUI. Its protocol documentation maps USB control requests from official-app captures and macOS binary analysis, covering routing, faders, metering and device profiles.","description_zh":"Monix 通过配套内核模块、协议库和图形界面为 Audient iD USB 声卡实现 Linux 混音控制。协议文档依据厂商应用的 USB 抓包及 macOS 二进制分析，整理路由、推子、电平表和设备配置的控制请求。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"sf2recomp-case","name":"SF2Recomp: statically recompiling Shadow Fight 2 for native platforms","name_zh":"SF2Recomp：将《Shadow Fight 2》静态重编译到原生平台","url":"https://github.com/bipinkrish/sf2recomp","evidence_url":"https://github.com/bipinkrish/sf2recomp/blob/e7ba03aaaa8394e4beda15eb8b321c8a01621e3f/README.md","description_en":"SF2Recomp converts a user's Shadow Fight 2 Nintendo Switch game files into native builds for Linux, Windows, macOS, and Android. Its converter combines translated game code with a runtime and user-supplied assets, adding controls, graphics options, sparring, and LAN play.","description_zh":"SF2Recomp 将用户提供的 Nintendo Switch 版《Shadow Fight 2》游戏文件转换为 Linux、Windows、macOS 和 Android 原生版本。转换器将重编译代码、运行时与用户素材结合，并加入控制设置、画面选项、对战练习及局域网联机。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"scooter-link-case","name":"Scooter Link: a Xiaomi scooter client built from BLE protocol research","name_zh":"Scooter Link：基于 BLE 协议研究的小米滑板车客户端","url":"https://github.com/desperado0044/xiaomi-scooter-link","evidence_url":"https://github.com/desperado0044/xiaomi-scooter-link/blob/46c3e4c0cbf5e802cd6965dd18f0fc1e0177f9b8/README.md","description_en":"Scooter Link implements an Android client for Xiaomi Electric Scooter 5 Pro and 5 Max using a reconstructed BLE authentication protocol. Its research log covers GATT characteristics and investigation of the ECDH P-256, HKDF-SHA256, and AES-CCM exchange; the app reads ride and battery data and controls supported settings.","description_zh":"Scooter Link 使用还原的 BLE 认证协议，为 Xiaomi Electric Scooter 5 Pro 和 5 Max 提供 Android 客户端。研究日志记录 GATT 特征及 ECDH P-256、HKDF-SHA256、AES-CCM 交互的调查；应用可读取骑行、电池数据并控制受支持的设置。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"sony-bravia-linux-case","name":"sony-bravia-linux: pre-Android BRAVIA platform and media behavior","name_zh":"sony-bravia-linux：前 Android 时代 BRAVIA 平台与媒体行为调查","url":"https://github.com/danielcamposramos/sony-bravia-linux","evidence_url":"https://github.com/danielcamposramos/sony-bravia-linux/blob/b5e616ee01f1486d52a2b1d3317415605f538bf1/README.md","description_en":"sony-bravia-linux investigates the Linux-based, pre-Android Sony BRAVIA platform and reconstructs selected media and portal behavior for owner-run services. Its documentation records observations from 2011–2012 AZ1, AZ2 and AZ3 sets, including remote input, browser media handling and 3D signalling. The repository also contains tools for H.264 3D SEI and related media workflows.","description_zh":"sony-bravia-linux 调查基于 Linux 的前 Android 时代 Sony BRAVIA 平台，并为用户自建服务还原部分媒体和门户行为。文档记录了 2011 至 2012 年 AZ1、AZ2、AZ3 系列电视的遥控输入、浏览器媒体处理和 3D 信号表现；仓库也提供处理 H.264 3D SEI 等媒体流程的工具。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"dfsdk","name":"dfsdk","name_zh":"dfsdk Delta Force 对象结构导出器","url":"https://github.com/3r4y/dfsdk","evidence_url":"https://github.com/3r4y/dfsdk/blob/eb9745d390cdffa4e1490bb132242cd8a8e33c53/README.md","description_en":"dfsdk dumps Delta Force object metadata by enumerating its object array, decoding per-entry XOR-encrypted names and walking class super chains and property lists. The README documents name-pool addressing, pointer masking, selected field offsets and example output.","description_zh":"dfsdk 遍历 Delta Force 对象数组，解码逐条 XOR 加密的名称，并沿类继承链和属性列表导出对象元数据。README 记录了名称池寻址、指针掩码、部分字段偏移和示例输出。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"sb-ae9-case","name":"Sound Blaster AE-9: reconstructing Linux control from Windows driver analysis","name_zh":"Sound Blaster AE-9：通过 Windows 驱动分析重建 Linux 控制","url":"https://github.com/verzic/sb-ae9","evidence_url":"https://github.com/verzic/sb-ae9/blob/cbfef7e0de0b90915793715d13ba5b6c79cd5ea9/docs/reverse-engineering/ctxhda-acm-analysis.md","description_en":"Sound Blaster AE-9 Linux support reconstructs card and Audio Control Module behavior using static analysis of Creative's Windows drivers and hardware observations. The included investigations document CtxHda.sys, CtxHdb.sys, and the ACM's SysEx-framed UART protocol; the driver implements selected playback and controls.","description_zh":"Sound Blaster AE-9 的 Linux 支持项目通过静态分析 Creative Windows 驱动并观察硬件行为，重建声卡及 Audio Control Module 的部分控制逻辑。仓库记录 CtxHda.sys、CtxHdb.sys 和 ACM 的 SysEx 帧 UART 协议，驱动实现了部分播放与控制功能。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","protocol"],"verified_at":"2026-11-06"},{"id":"kbot","name":"KBot","name_zh":"KBot《Total Annihilation》文件格式与脚本分析工具","url":"https://github.com/coreprime/kbot","evidence_url":"https://github.com/coreprime/kbot/blob/0ab97bfd2633983ba276a3e67ceb76eac95731ff/README.md","description_en":"KBot inspects and transforms Total Annihilation and TA: Kingdoms game files, pairing a Go CLI with a proprietary format reference. It decompiles COB bytecode to BOS source, disassembles scripts, checks round trips and examines formats including HPI archives, GAF sprites, TNT maps and 3DO models.","description_zh":"KBot 将 Go 命令行工具与专有格式参考文档结合，用于检查和转换《Total Annihilation》及《TA: Kingdoms》的游戏文件。它把 COB 字节码反编译成 BOS、反汇编脚本并检查往返转换，还分析 HPI 归档、GAF 精灵、TNT 地图和 3DO 模型等格式。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"thermalmaster-case","name":"thermalmaster: a Go client for ThermalMaster camera USB commands","name_zh":"thermalmaster：ThermalMaster 热像仪 USB 协议的 Go 客户端","url":"https://github.com/xaionaro-go/thermalmaster","evidence_url":"https://github.com/xaionaro-go/thermalmaster/blob/4a52a1fa82fbd996a57b02a19ea6d4a4472d21b8/doc/reverse-engineering.md","description_en":"thermalmaster implements a Go USB client for ThermalMaster P3 and P1 thermal cameras using documented VDCMD control transfers. It captures PNG frames, streams thermal and IR video to Linux v4l2loopback, and records USB command framing and model identifiers for interoperability.","description_zh":"thermalmaster 根据所记录的 VDCMD USB 控制传输，为 ThermalMaster P3 和 P1 热像仪实现 Go 客户端。它可抓取 PNG 画面，并向 Linux v4l2loopback 输出热成像和红外视频；协议文档列出 USB 命令格式与设备型号标识。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"cpp2cs","name":"Cpp2CS","name_zh":"Cpp2CS IL2CPP 托管代码恢复工具","url":"https://github.com/MetaMikuAI/Cpp2CS","evidence_url":"https://github.com/MetaMikuAI/Cpp2CS/blob/c1acd6b652bb00c68c7187640c76159ccde521f1/README.md","description_en":"Cpp2CS recovers managed methods from Android ARM64 Unity IL2CPP ELF binaries and matching metadata, emitting CIL assemblies, C# source and per-method diagnostics. Its pipeline models machine IR, IL2CPP runtime idioms, memory SSA and type recovery while marking unresolved portions.","description_zh":"Cpp2CS 从 Android ARM64 Unity IL2CPP ELF 二进制文件和匹配元数据中恢复托管方法，输出 CIL 程序集、C# 源码及逐方法诊断。其流程建模机器 IR、运行时惯用法、内存 SSA 和类型，并标记未恢复部分。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"ghidra-c6000","name":"ghidra-c6000","name_zh":"ghidra-c6000 TI C6000 DSP 分析扩展","url":"https://github.com/geepot/ghidra-c6000","evidence_url":"https://github.com/geepot/ghidra-c6000/blob/6cf197eb6602dfa9812a888cb0ea23f5862f4f46/README.md","description_en":"ghidra-c6000 adds Texas Instruments C64x, C67x and C674x DSP support to Ghidra 12.x. Its SLEIGH languages decode full-width and compact instructions, supply p-code for decompilation, and add C6000 calling conventions and packet-aware analyzers for ELF or raw images.","description_zh":"ghidra-c6000 为 Ghidra 12.x 增加德州仪器 C64x、C67x 和 C674x DSP 支持。其 SLEIGH 语言解码完整及紧凑指令，提供反编译所需的 p-code，并为 ELF 或原始镜像加入 C6000 调用约定和指令包分析器。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"sheypoor-mcp-case","name":"Sheypoor MCP: mapping marketplace APIs from browser traffic","name_zh":"Sheypoor MCP：从浏览器流量还原分类信息网站接口","url":"https://github.com/FarhamAghdasi/sheypoor-mcp","evidence_url":"https://github.com/FarhamAghdasi/sheypoor-mcp/blob/5f544185ed9c84797f683e3e1ab36fe3e8ae7146/document/api-reference.md","description_en":"Sheypoor MCP implements a client and MCP server for the Sheypoor classifieds site using API behavior documented from browser traffic. Its reference records observed endpoints, request headers, cookies and phone-based login. The server exposes listing search and details, account functions, chat room lists and unread message counts to MCP clients.","description_zh":"Sheypoor MCP 根据浏览器流量记录的接口行为，为 Sheypoor 分类信息网站实现客户端和 MCP 服务器。其文档列出已观察到的接口、请求头、Cookie 和手机短信验证码登录流程。服务器向 MCP 客户端提供信息搜索与详情、账户功能，以及聊天会话列表和未读消息数。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["website"],"verified_at":"2026-11-06"},{"id":"open-rknpu-case","name":"open-rknpu: Rockchip NPU task-program reconstruction","name_zh":"open-rknpu：Rockchip NPU 任务程序还原","url":"https://github.com/dnhkng/open-rknpu","evidence_url":"https://github.com/dnhkng/open-rknpu/blob/0e0afcd1b00058255590bf19d644e12bea13af38/README.md","description_en":"open-rknpu reconstructs a task-program interface for the Rockchip RV1103/RV1106 NPU from board experiments and black-box comparisons. Its Python compiler emits register commands, weight and quantization blocks, and a container for bounded static ONNX convolution graphs; a C runtime submits them through /dev/rknpu. Research files document register and numerical findings.","description_zh":"open-rknpu 通过板卡实验和黑盒对照还原 Rockchip RV1103/RV1106 NPU 的任务程序接口。Python 编译器为限定范围内的静态 ONNX 卷积图生成寄存器命令、权重与量化数据块及容器文件；C 运行时经 /dev/rknpu 提交任务。研究文件记录了寄存器和数值行为。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"dmc-recomp-case","name":"Devil May Cry: an experimental PS2 static recompilation","name_zh":"Devil May Cry：实验性的 PS2 静态重编译","url":"https://github.com/Gui-Tora/dmc-recomp","evidence_url":"https://github.com/Gui-Tora/dmc-recomp/blob/dea53cc65ae47dad870bebd2e387f8af698cc97a/README.md","description_en":"dmc-recomp translates the PlayStation 2 PAL release of Devil May Cry into native PC code through PS2Recomp and a project runtime. Its pipeline rebuilds generated code locally from the user’s own game executable, while research notes and patches track boot, CD services, MPEG playback, rendering and gameplay behavior.","description_zh":"dmc-recomp 借助 PS2Recomp 和项目运行时，将 PAL 欧版 PlayStation 2 游戏 Devil May Cry 转换为 PC 原生代码。其流水线从用户自行提供的游戏可执行文件在本地生成代码，研究笔记和补丁记录启动、光盘服务、MPEG 播放、渲染及游戏流程的分析。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"hardsid4u-case","name":"hardsid4u: reconstructing the HardSID 4U USB protocol","name_zh":"hardsid4u：还原 HardSID 4U USB 协议","url":"https://github.com/pjthulin/hardsid4u","evidence_url":"https://github.com/pjthulin/hardsid4u/blob/539fdb2d0b9b1a721fa344c6d4300cf34911e654/README.md","description_en":"hardsid4u reconstructs the HardSID 4U USB protocol and implements a libusb Python driver for its SID-chip sockets. The investigation combines vendor-binary analysis, USB captures, and hardware probes to document command framing, initialization, register writes, timing, and flow control; a MIDI instrument uses the driver.","description_zh":"hardsid4u 还原 HardSID 4U 的 USB 协议，并用 libusb 实现控制 SID 芯片插槽的 Python 驱动。研究结合厂商二进制分析、USB 抓包和硬件探测，记录报文封装、初始化、寄存器写入、时序及流量控制；MIDI 乐器建立在该驱动之上。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"ms4x","name":"MS4X","name_zh":"MS4X Siemens 发动机控制单元逆向工具与文档","url":"https://github.com/therudywolf/MS4X","evidence_url":"https://github.com/therudywolf/MS4X/blob/ac5e4cddbfc7afce3d30b598bbeaee759ad3f31c/README.md","description_en":"MS4X analyzes Siemens MS42 and MS43 engine-control firmware for BMW M52TU and M54 engines. Its Python tools disassemble and assemble C166 instructions and inspect image checksums, stock-code differences and TunerPro patchlists; companion documents cover memory maps and findings in the factory programs.","description_zh":"MS4X 分析 BMW M52TU、M54 发动机所用 Siemens MS42/MS43 控制单元固件。Python 工具负责 C166 反汇编与汇编，并检查镜像校验和、原厂代码差异及 TunerPro 补丁列表；文档记录内存映射和原厂程序发现。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"zcode-android-case","name":"ZCode-Android: reconstructing the ZCode remote-control client","name_zh":"ZCode-Android：重建 ZCode 远程控制客户端","url":"https://github.com/Damianjiang/ZCode-Android","evidence_url":"https://github.com/Damianjiang/ZCode-Android/blob/6b04daceafaa1d025994a3b44273fe74423da7d4/README.md","description_en":"ZCode-Android recreates ZCode remote control on Android from captured traffic and analysis of its official web page. Its Kotlin client implements WebSocket relay, HMAC pairing, IPC encoding, fragmented RPC frames and Conversation V4 session messages.","description_zh":"ZCode-Android 根据官方远程控制网页的抓包与逆向结果，在 Android 上重建 ZCode 会话控制。Kotlin 客户端实现 WebSocket 中继、HMAC 配对、IPC 编解码、RPC 分片帧和 Conversation V4 会话消息。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol","website"],"verified_at":"2026-11-06"},{"id":"pyeilik-case","name":"PyEilik: a client for the Eilik robot's USB protocol","name_zh":"PyEilik：Eilik 机器人的 USB 协议客户端","url":"https://github.com/aklto/PyEilik","evidence_url":"https://github.com/aklto/PyEilik/blob/b1bf7ea6f29b939cddee66ffadd498ad32d02aa0/README.md","description_en":"PyEilik implements control of an Eilik desk robot over a recovered USB serial protocol. Its C library and Python wrapper move four servos, read and update the 128×64 display, and play video with synchronized movement. The protocol reference documents 125000-baud framing, command IDs, checksums and acknowledgements.","description_zh":"PyEilik 基于恢复出的 USB 串行协议控制 Eilik 桌面机器人。C 库与 Python 封装可驱动四个舵机、读取和更新 128×64 屏幕，并在视频播放时同步动作。协议文档记录了 125000 波特率、帧结构、命令号、校验和及应答。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"libfprint-goodixtls-case","name":"libfprint-goodixtls: a reconstructed Goodix GXFP5187 fingerprint driver","name_zh":"libfprint-goodixtls：还原 Goodix GXFP5187 指纹驱动","url":"https://github.com/Sigfrodr/libfprint-goodixtls","evidence_url":"https://github.com/Sigfrodr/libfprint-goodixtls/blob/bdf2f7ece115005fc625e3a16950c80140f4946a/README.md","description_en":"libfprint-goodixtls reconstructs communication with the Goodix GXFP5187 SPI fingerprint sensor in the Huawei MateBook X Pro as a libfprint TOD driver. It reads a PSK from sensor RAM, establishes the sensor's TLS-PSK channel, decodes captured images, and uses local descriptors for host-side matching. The author reports enrolment and verification through fprintd and GNOME Settings; detailed reverse-engineering notes are kept outside the repository.","description_zh":"libfprint-goodixtls 为 Huawei MateBook X Pro 的 Goodix GXFP5187 SPI 指纹传感器实现 libfprint TOD 驱动。它从传感器内存读取 PSK，建立 TLS-PSK 通道，解码采集图像，并用局部特征描述子在主机端匹配。作者报告可通过 fprintd 和 GNOME 设置录入、验证指纹；详细的逆向研究笔记另行保存，未收入仓库。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"walksnail-ascent-vrx-uart","name":"Walksnail Ascent VRX UART Protocol","name_zh":"Walksnail Ascent VRX UART 协议资料","url":"https://github.com/maks421400-lgtm/Walksnail-Ascent-VRX-UART","evidence_url":"https://github.com/maks421400-lgtm/Walksnail-Ascent-VRX-UART/blob/9e4be3eb0032f17dd53e7a2e6de99b7917b71ab5/README.md","description_en":"Walksnail Ascent VRX UART Protocol documents serial control messages for Walksnail video receivers and supplies a C reference transmitter with an STM32 example. It specifies framing, payload checksums, remote keys, channel selection and status queries, while recording contradictions and unknown reply layouts.","description_zh":"Walksnail Ascent VRX UART Protocol 记录 Walksnail 视频接收机的串口控制消息，并提供 C 语言发送实现和 STM32 示例。资料涵盖帧结构、校验和、按键、频道选择与状态查询，同时标明来源中的矛盾和未知回复格式。","kind":"documentation","category":"protocol-analysis","group":"learn","relationship":"learning","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"sin-punishment-recompiled-case","name":"Sin & Punishment: a work-in-progress N64 static recompilation","name_zh":"Sin & Punishment：开发中的 N64 静态重编译移植","url":"https://github.com/maximilianoide/sin-punishment-recompiled","evidence_url":"https://github.com/maximilianoide/sin-punishment-recompiled/blob/8c31a07009464a0f285fb40e252789393bd101b1/README.md","description_en":"Sin & Punishment: Recompiled uses N64Recomp and RSPRecomp to build an experimental native C++ port from a user-supplied Japanese N64 ROM and the repository's symbol maps, with RT64 rendering. The author reports that it reaches the title screen; menu navigation, gameplay, audio validation, and a public pipeline for its patched working image remain unfinished.","description_zh":"Sin & Punishment: Recompiled 使用 N64Recomp 和 RSPRecomp，基于用户提供的日版 N64 ROM 及仓库中的符号映射构建原生 C++ 移植程序，并通过 RT64 渲染。作者报告程序已进入标题画面；菜单导航、游戏流程、音频验证，以及补丁工作镜像的公开生成流程仍待完成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"scvk-case","name":"scvk: replacing SimCity 4's renderer with Vulkan","name_zh":"scvk：以 Vulkan 替换 SimCity 4 渲染器","url":"https://github.com/aspctt/scvk","evidence_url":"https://github.com/aspctt/scvk/blob/5827705ac9f9dcb08ecf1c5989153c616aba5462/README.md","description_en":"scvk reconstructs SimCity 4's renderer interface as a native Vulkan DLL loaded through the game's GZCOM plugin system. It claims existing renderer class IDs and emulates the cIGZGDriver fixed-function API with pipeline state and shaders for terrain, buildings, lighting, textures and interface drawing.","description_zh":"scvk 通过 SimCity 4 的 GZCOM 插件系统加载原生 Vulkan DLL，以替换游戏渲染器。它使用已有的渲染器类 ID，并通过管线状态和着色器模拟 cIGZGDriver 固定功能接口，绘制地形、建筑、光照、纹理和界面。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"razerstream-case","name":"RazerStream: reconstructing Stream Controller device control","name_zh":"RazerStream：重建 Stream Controller 设备控制功能","url":"https://github.com/ShoelessTim/RazerStream","evidence_url":"https://github.com/ShoelessTim/RazerStream/blob/3d762a19394b5e830d9dcb66675d435596f19df8/README.md","description_en":"RazerStream replaces the retired control software for the Razer Stream Controller with a macOS app, Swift protocol library and CLI. Its documented device protocol runs over a USB serial port, performs a WebSocket upgrade, then exchanges framed commands and input events. The app configures touchscreen tiles, knobs, buttons and LEDs.","description_zh":"RazerStream 用 macOS 应用、Swift 协议库和命令行工具替代 Razer Stream Controller 已停用的控制软件。文档记录设备通过 USB 串口完成 WebSocket 升级，再交换封装的命令与输入事件；应用可配置触摸屏按键、旋钮、实体按钮和 LED。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"dabplayplus-case","name":"DABplay+: reconstructing USB DAB+ dongle control","name_zh":"DABplay+：重建 USB DAB+ 接收器控制协议","url":"https://github.com/jvspier/dabplayplus","evidence_url":"https://github.com/jvspier/dabplayplus/blob/f9355864b9a452d00813f08e3453a1249736e89a/README.md","description_en":"DABplay+ implements an Android DAB radio using a reverse-engineered USB dongle protocol. It drives the DTR-100 family directly, decodes broadcast data and audio, and documents additional dongle protocols alongside hardware findings and tests.","description_zh":"DABplay+ 借助逆向得到的 USB 接收器协议实现 Android DAB 收音机，可直接控制 DTR-100 系列设备并解码广播数据与音频。仓库还记录其他接收器协议、硬件发现和测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"t2-platform-research","name":"T2 platform research","name_zh":"T2 platform research Apple T2 平台研究","url":"https://github.com/macintog/t2-platform-research","evidence_url":"https://github.com/macintog/t2-platform-research/blob/423d2b056b69764876097818b3efc74319a7f944/README.md","description_en":"T2 platform research maps Apple T2 firmware, hardware and Linux-facing interfaces using static analysis, hardware observations and driver comparisons. Its chapters cover Secure Enclave services, boot and recovery, graphics, audio, sensors, storage and other subsystems. Machine-readable findings and board indexes connect claims to their evidence, with Python reference code for selected message formats.","description_zh":"T2 platform research 通过静态分析、硬件观察和驱动比对，整理 Apple T2 的固件、硬件及 Linux 所需接口。研究章节覆盖 Secure Enclave 服务、启动与恢复、图形、音频、传感器和存储等子系统。机器可读的研究发现和主板索引将结论与证据关联，并标明适用范围；仓库还提供部分消息格式的 Python 参考代码。","kind":"research","category":"firmware","group":"learn","relationship":"learning","targets":["firmware","protocol"],"verified_at":"2026-11-06"},{"id":"pocketprinter5890-case","name":"PocketPrinter5890: reconstructing the Lidl 5890 printer protocol","name_zh":"PocketPrinter5890：重建 Lidl 5890 打印机协议","url":"https://github.com/dimer47/PocketPrinter5890","evidence_url":"https://github.com/dimer47/PocketPrinter5890/blob/20118975f6e58d5910657d7ba3daa62c3e5edae9/README.md","description_en":"PocketPrinter5890 reconstructs the BLE printing protocol of Lidl's Tronic, SILVERCREST, and Parkside model 5890 pocket printers. Its specification documents activation writes, flow-control credits, and raster bands; Swift, Kotlin, and TypeScript libraries implement printing for Apple devices, Android, and browsers.","description_zh":"PocketPrinter5890 重建了 Lidl Tronic、SILVERCREST 和 Parkside 5890 型便携热敏打印机的 BLE 打印协议。协议文档记录激活写入、流控额度和分段光栅传输；Swift、Kotlin、TypeScript 库分别面向 Apple 设备、Android 和浏览器。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"salamander-uefi-case","name":"Salamander UEFI: a disassembly-based UEFI port of the NES game","name_zh":"Salamander UEFI：《沙罗曼蛇》的反汇编驱动 UEFI 移植","url":"https://github.com/MikeWuPing/UEFI_Salamander","evidence_url":"https://github.com/MikeWuPing/UEFI_Salamander/blob/56160dc0587b8729d0cf731c7fff0e7ad2581eb3/README_en.md","description_en":"Salamander UEFI ports the NES game Salamander to a native UEFI Shell application by translating its 6502 disassembly into a platform-independent C core. The repository includes a 6502 disassembler, a user-ROM resource extractor, host tests and a fidelity checklist. UEFI GOP, input and timing services replace the original console environment.","description_zh":"Salamander UEFI 将红白机游戏《沙罗曼蛇》的 6502 反汇编翻译成平台无关的 C 核心，移植为原生 UEFI Shell 应用。仓库提供 6502 反汇编器、基于用户自有 ROM 的资源提取器、宿主机测试和保真清单，以 UEFI GOP、输入和定时服务替代原主机环境。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"cocos2d-dumper","name":"cocos2d-dumper","name_zh":"cocos2d-dumper ELF 函数符号提取工具","url":"https://github.com/d1xus/cocos2d-dumper","evidence_url":"https://github.com/d1xus/cocos2d-dumper/blob/c53f57c2063a11c9be35aba453d2537ed8a1f093/README.md","description_en":"cocos2d-dumper extracts defined function symbols from ELF shared libraries and demangles C++ names with GNU binutils. It produces a map of ELF symbol values and names for inspecting unstripped cocos2d-x binaries and other native libraries.","description_zh":"cocos2d-dumper 使用 GNU binutils 从 ELF 共享库提取已定义的函数符号，并对 C++ 名称进行反修饰。它生成 ELF 符号表值与名称的对应表，可用于检查未剥离符号的 cocos2d-x 二进制文件及其他原生库。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"binary-ninja-security-analysis-plugin","name":"Binary Ninja Security Analysis Plugin","name_zh":"Binary Ninja Security Analysis Plugin 二进制分析插件","url":"https://github.com/meerkatone/rust_binary_analysis","evidence_url":"https://github.com/meerkatone/rust_binary_analysis/blob/5abf11b7b6d12c23a3e1cd19b01137c8a209fbea/README.md","description_en":"Binary Ninja Security Analysis Plugin batches binary analysis from a Rust plugin and exports Parquet reports. It records architecture, hashes, functions, strings, segments, cyclomatic complexity, entropy and references to selected process-execution functions.","description_zh":"Binary Ninja Security Analysis Plugin 是用 Rust 编写的批量二进制分析插件，输出 Parquet 报告。报告包含架构、哈希、函数、字符串、段、圈复杂度、熵，以及指向指定进程执行函数的交叉引用。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"nwbinanalyzer","name":"NWBinAnalyzer","name_zh":"NWBinAnalyzer NW.js 二进制分析器","url":"https://github.com/Netizen-alt/NWBinAnalyzer","evidence_url":"https://github.com/Netizen-alt/NWBinAnalyzer/blob/02186511f5b9560566d52f3450ff82f91e624315/README.md","description_en":"NWBinAnalyzer inspects compiled NW.js .bin files by checking their header and walking constant-pool entries. Its Python code extracts UTF-8, null-terminated and length-prefixed strings, then groups findings such as API names, paths, URLs and cryptographic terms.","description_zh":"NWBinAnalyzer 检查 NW.js 编译后的 .bin 文件头并遍历常量池条目。其 Python 程序提取 UTF-8、空终止及带长度前缀的字符串，再按 API 名称、路径、URL 和密码学术语等类别整理。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"parking-sensor-protocol-case","name":"Parking sensor kit: reconstructing its display protocol","name_zh":"Parking sensor kit：倒车雷达显示协议重建","url":"https://github.com/kunkka-project/re_parking_sensor_protocol","evidence_url":"https://github.com/kunkka-project/re_parking_sensor_protocol/blob/ecd40b705217db9ba33c9c2cdfd56f4f5ce2c668/README.md","description_en":"This parking-sensor investigation reconstructs the signal sent from a kit's controller to its display. Oscilloscope observations and tests with different sensor states identify fields in roughly 48-bit frames for sensor address, connection and proximity. A PlatformIO example for ATmega328P reads and reports the parsed frames.","description_zh":"该倒车雷达研究重建控制板向显示器发送的信号。作者结合示波器观察与不同传感器状态测试，在约 48 位的帧中定位传感器地址、连接状态和接近程度标志，并提供基于 ATmega328P 的 PlatformIO 解析示例。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"glaurung-models","name":"Glaurung Models","name_zh":"Glaurung Models 可执行文件分词模型研究","url":"https://github.com/mjbommar/glaurung-models","evidence_url":"https://github.com/mjbommar/glaurung-models/blob/1819020f447d55f55b629b78ba96502edae71715/glaurung_binary_tokenizer_001_README.md","description_en":"Glaurung Models contains tokenizer and model experiments for executable analysis. Its documented 64K BPE tokenizer encodes compiled PE and ELF bytes using Latin-1, with x86 and ARM64 training coverage; an accompanying analysis compares learned SSE and AVX instruction patterns across two tokenizers.","description_zh":"Glaurung Models 收录面向可执行文件分析的分词器与模型实验。其 64K BPE 分词器以 Latin-1 编码 PE 和 ELF 字节，训练范围涵盖 x86 与 ARM64；附带分析比较了两个分词器学到的 SSE 和 AVX 指令模式。","kind":"research","category":"native-analysis","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-11-06"},{"id":"pyhaseiq-case","name":"pyhaseiq: reconstructing the older Hase iQ stove's WebSocket protocol","name_zh":"pyhaseiq：复原旧款 Hase iQ 炉具的 WebSocket 协议","url":"https://github.com/bbayszczak/pyhaseiq","evidence_url":"https://github.com/bbayszczak/pyhaseiq/blob/e7bb8ce2f9350099d8c8a97daeffdb8c26d02f46/docs/SPEC-WS-PROTOCOL.md","description_en":"pyhaseiq reconstructs the local WebSocket protocol of Hase iQ wood stoves used with the flamemonitor app and implements an asynchronous read-only Python client. The specification records base64-encoded request and response frames, serial dialogue and observation status for each finding; the client reads combustion phase, temperature and performance.","description_zh":"pyhaseiq 复原与 flamemonitor 应用配套的旧款 Hase iQ 木炉本地 WebSocket 协议，并实现异步、只读的 Python 客户端。协议文档记录 base64 编码的请求与应答、串行交互及各项结论的证据状态；客户端读取燃烧阶段、温度和性能数值。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"crackmes-writeups","name":"CrackMes","name_zh":"CrackMes 二进制逆向练习题解析","url":"https://github.com/ghostware0x00/CrackMes","evidence_url":"https://github.com/ghostware0x00/CrackMes/blob/dea5860826334360ac9f97bdbfab1f444e6be67c/Linux/X86X64/CC%2B%2B/2.0/good%20kitty/Writeup.md","description_en":"CrackMes is a set of walkthroughs for purpose-built crackme binaries from crackmes.one. The supplied Linux x86-64 examples identify ELF executables, inspect program disassembly, use breakpoints and runtime observations, and explain how candidate input is checked.","description_zh":"CrackMes 收录 crackmes.one 专用逆向练习程序的解析文章。 Linux x86-64 示例识别 ELF 可执行文件、检查反汇编、使用断点和运行时观察，并说明输入值的校验过程。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-11-06"},{"id":"human-readable-decompilation","name":"Human-Readable Decompilation","name_zh":"Human-Readable Decompilation 反编译 C 代码整理工具","url":"https://github.com/aaronwb/human-readable-decompilation","evidence_url":"https://github.com/aaronwb/human-readable-decompilation/blob/1cde62db2e3c941ea1ba6dfea67394124704fc58/README.md","description_en":"Human-Readable Decompilation restructures C produced by Ghidra's binary decompiler using an ANTLR parser and AST transformations. It recovers switches from conditional chains, introduces guard clauses, flattens nested branches and simplifies selected expressions. A GUI can launch Ghidra headlessly before transformation, while a CLI handles existing C output.","description_zh":"Human-Readable Decompilation 使用 ANTLR 解析 Ghidra 从二进制文件反编译得到的 C 代码，并进行 AST 转换。功能包括从条件链恢复 switch、引入卫语句、压平嵌套分支及简化部分表达式；图形界面可先启动 Ghidra 无头分析，命令行也能处理已有 C 文件。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"binstruct-inspector","name":"BinStruct Inspector","name_zh":"BinStruct Inspector 二进制结构分析器","url":"https://github.com/1051093860/BinStruct-Inspector","evidence_url":"https://github.com/1051093860/BinStruct-Inspector/blob/568a3b86f171e72f53f401a0406accc02f09433e/README.md","description_en":"BinStruct Inspector is a GUI for examining binary file layouts through user-defined field trees. It parses files as structures are edited, shows parsed values beside synchronized hex and JSON views, and tracks byte-level insertions, deletions, and replacements; plugins add custom data types.","description_zh":"BinStruct Inspector 是通过自定义字段树检查二进制文件布局的图形工具。编辑结构时可实时解析文件，并同步显示字段值、十六进制和 JSON 视图；差异监控记录字节级增删替换，插件可扩展数据类型。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"simpleparserpe","name":"SimpleParserPE","name_zh":"SimpleParserPE PE32 文件解析器","url":"https://github.com/wmitq/SimpleParserPE","evidence_url":"https://github.com/wmitq/SimpleParserPE/blob/0e3f99c47587c5797e3201800729519cacbf8a5c/README.md","description_en":"SimpleParserPE is a C++ command-line inspector for PE32 Windows executables. It reads DOS and NT headers, section metadata, data directories, and imported DLL functions, translating RVAs through the section table without Windows headers or external libraries.","description_zh":"SimpleParserPE 是检查 PE32 Windows 可执行文件的 C++ 命令行工具。它读取 DOS、NT 文件头、节信息、数据目录和 DLL 导入函数，并通过节表换算 RVA；实现不依赖 Windows 头文件或外部库。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"bndextract-kuon","name":"BNDExtract","name_zh":"BNDExtract《九怨》BND 归档提取工具","url":"https://github.com/fferradamerino/bnd_extract","evidence_url":"https://github.com/fferradamerino/bnd_extract/blob/dc6607b48b8e35e441eefe4940d4ccaf1edacac1/README.md","description_en":"BNDExtract is a Go command-line tool for extracting the ALL.BND archive used by Kuon and some other FromSoftware PlayStation 2 games. It takes a .bnd file and an output directory, providing access to the archive's contents for inspection.","description_zh":"BNDExtract 是 Go 命令行工具，用于提取《九怨》及部分其他 FromSoftware PlayStation 2 游戏的 ALL.BND 归档。输入 .bnd 文件和输出目录后，可取得归档内容供检查。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"tenet-tracer","name":"tenet_tracer","name_zh":"tenet_tracer Tenet 指令轨迹采集器","url":"https://github.com/mahmoudimus/tenet_tracer","evidence_url":"https://github.com/mahmoudimus/tenet_tracer/blob/26fa9b426c7ef5a6c6b6d9526f39aba1dbdbf57f/README.md","description_en":"tenet_tracer uses Intel Pin to record instruction-level execution traces for Tenet. It captures program counters, register changes and memory accesses, stores them in SQLite tables, and provides a script to export the trace text.","description_zh":"tenet_tracer 使用 Intel Pin 采集指令级执行轨迹，供 Tenet 查看。它记录程序计数器、寄存器变化和内存访问，将轨迹存入 SQLite 表，并提供导出文本的脚本。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"binary-bpe-tokenizer-research","name":"Binary BPE Tokenizer for Executable Analysis","name_zh":"Binary BPE Tokenizer for Executable Analysis 可执行文件分析分词研究","url":"https://github.com/mjbommar/binary-tokenizer-paper","evidence_url":"https://github.com/mjbommar/binary-tokenizer-paper/blob/7ef1ec7739a37437c229423847c04d9295c82a0e/README.md","description_en":"Binary BPE Tokenizer for Executable Analysis studies byte-pair encoding of ELF, PE, Mach-O and APK files for transformer-based binary analysis. The repository provides paper sources, 4K to 64K tokenizer vocabularies, Python evaluation scripts and a sample archive. The author reports 2.89 bytes per token for the 64K vocabulary.","description_zh":"Binary BPE Tokenizer for Executable Analysis 研究面向 Transformer 二进制分析的 ELF、PE、Mach-O 和 APK 字节对编码。仓库包含论文源文件、4K 至 64K 词表、Python 评测脚本和样本压缩包。作者报告 64K 词表平均每个 token 对应 2.89 字节。","kind":"research","category":"native-analysis","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-11-06"},{"id":"power-bi-report-query-case","name":"Power BI API Scraper: decoding a published report query format","name_zh":"Power BI API Scraper：解析公开报表查询格式","url":"https://github.com/artemiyDev/powerbi_api_scraper","evidence_url":"https://github.com/artemiyDev/powerbi_api_scraper/blob/053ffeaec40a2c85a1086c3bb9b36c5d4d19ea87/README.md","description_en":"Power BI API Scraper reconstructs the web client's undocumented query and response format for published reports. It sends SemanticQueryDataShapeCommand requests, follows restart tokens and expands bitsets and ValueDicts into CSV rows. The included example is hardcoded for an Ohio liquor permit report.","description_zh":"Power BI API Scraper 还原公开报表所用的网页客户端查询与响应格式。程序发送 SemanticQueryDataShapeCommand 请求，使用重启令牌翻页，并将位集和 ValueDicts 还原为 CSV 行；附带示例固定针对俄亥俄州酒类许可证报表。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol","website"],"verified_at":"2026-11-06"},{"id":"m0rph-ctf-analysis-case","name":"m0rph: tracing an obfuscated ELF flag checker","name_zh":"m0rph：追踪混淆 ELF 程序的字符串校验逻辑","url":"https://github.com/UmbertoDellaMonica/m0rph-CTF-CyberChallenge.IT","evidence_url":"https://github.com/UmbertoDellaMonica/m0rph-CTF-CyberChallenge.IT/blob/064dbf1bcedd39a0360a311daaa86c32b525a7db/README.md","description_en":"The m0rph investigation examines an obfuscated x86-64 ELF CTF flag checker with readelf, strings, Cutter and Radare2. Its write-up traces indirect CALL RAX execution into allocated memory and describes recovering expected characters by breaking at the call and inspecting RDI during each loop iteration.","description_zh":"m0rph 调查使用 readelf、strings、Cutter 和 Radare2 分析一款经过混淆的 x86-64 ELF CTF 字符串校验程序。报告追踪 CALL RAX 跳转到动态分配内存的执行过程，并说明如何逐次在调用处设断点、检查 RDI 以还原预期字符。","kind":"case-study","category":"native-analysis","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-11-06"},{"id":"opentracks-uwp-case","name":"OpenTracks: a UWP port of OpenTracks7 BETA1","name_zh":"OpenTracks：OpenTracks7 BETA1 的 UWP 移植","url":"https://github.com/mediaexplorer74/OpenTracks","evidence_url":"https://github.com/mediaexplorer74/OpenTracks/blob/b9608866abf178df2a5accc8d5a4ba531eb5e5a1/README.md","description_en":"OpenTracks is an early UWP port of the OpenTracks7 BETA1 Windows Phone music app informed by the author's reverse engineering. Its C# and XAML implementation updates page control access and replaces WP7 MediaPlayerLauncher with UWP media playback APIs.","description_zh":"OpenTracks 是基于作者对 OpenTracks7 BETA1 的逆向研究所做的早期 UWP 移植。仓库中的 C# 和 XAML 实现更新了页面控件访问方式，并以 UWP 媒体播放 API 替换 WP7 的 MediaPlayerLauncher。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-11-06"},{"id":"binscan","name":"BinScan","name_zh":"BinScan 批量二进制文件结构分析工具","url":"https://github.com/Mraxzist/BinScan","evidence_url":"https://github.com/Mraxzist/BinScan/blob/7bd7e78526a566ff16ade4019d48b3914297c534/README.md","description_en":"BinScan scans files in bulk and emits per-file JSON containing format identification, structural metadata, hashes and entropy. Its C++ library includes parsers for PE, ELF and Mach-O executables alongside archives, packages, documents and images, with a staged read, analyze and write pipeline.","description_zh":"BinScan 批量扫描文件，为每个文件输出含格式识别、结构信息、哈希和熵值的 JSON。其 C++ 库包含 PE、ELF、Mach-O 可执行文件及压缩包、安装包、文档和图像的解析器，按读取、分析、写入三个阶段处理。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"patch-0xc0000022","name":"Patch-0xC0000022","name_zh":"Patch-0xC0000022 SysMain 运行时研究工具","url":"https://github.com/Harryson3001/Patch-0xC0000022","evidence_url":"https://github.com/Harryson3001/Patch-0xC0000022/blob/fdce6b22c293cba15d6cc991018f4bbf285d8f7d/README.md","description_en":"Patch-0xC0000022 instruments the running Windows SysMain service by changing its NtCreateFile response to STATUS_ACCESS_DENIED. The C++ program finds the service process, resolves the remote function address and applies a six-byte patch to study the effect on prefetch behavior.","description_zh":"Patch-0xC0000022 修改运行中的 Windows SysMain 服务，使 NtCreateFile 返回 STATUS_ACCESS_DENIED。该 C++ 程序定位服务进程和远程函数地址，再应用六字节补丁，以研究预取行为的变化。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"led-controller-banlanx-case","name":"LED Controller: a BanlanX BLE client with audio-feed protocol findings","name_zh":"LED Controller：基于 BanlanX BLE 协议及音频数据发现的客户端","url":"https://github.com/Antrubtor/LED-controller","evidence_url":"https://github.com/Antrubtor/LED-controller/blob/f2c7c5f196b28f960d19ceb8e3d44dbfaded5f3c/README.md","description_en":"LED Controller uses BanlanX BLE commands to control SP611E-family LED strips from a desktop app. Its documentation maps GATT commands and state notifications, and reports probing an audio-feed message used by the controller’s music effects; included tools inspect advertisements, GATT state and Bluetooth captures.","description_zh":"LED Controller 通过 BanlanX BLE 命令在电脑上控制 SP611E 系列灯带。文档列出 GATT 命令和状态通知，记录作者探测到的音乐效果音频数据消息；随附工具可检查广播、GATT 状态与蓝牙抓包。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"cpq-iosched-case","name":"CPQ IO Scheduler: reconstructing Xiaomi's block scheduler","name_zh":"CPQ IO Scheduler：还原小米的块设备调度器","url":"https://github.com/Rasenkai/CPQ_IOSched","evidence_url":"https://github.com/Rasenkai/CPQ_IOSched/blob/ed5989340818224d58b0fba9b4f4aebd99545e3d/README.md","description_en":"CPQ IO Scheduler reconstructs Xiaomi's proprietary cpq.ko Linux block scheduler from a stripped ARM64 kernel module. Its out-of-tree C implementation combines priority classes, thread-group queues, deadline handling, and blk-mq elevator integration, with a whitepaper and author-reported benchmarks.","description_zh":"CPQ IO Scheduler 从已剥离符号的 ARM64 cpq.ko 内核模块还原小米的 Linux 块设备调度器。独立 C 模块实现优先级类别、线程组队列、期限处理及 blk-mq elevator 集成，并附技术论文和作者报告的基准测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary"],"verified_at":"2026-11-06"},{"id":"zemismart-blind-protocol-case","name":"Zemismart Blind Controller Protocol: RF command reconstruction","name_zh":"Zemismart Blind Controller Protocol：射频控制命令还原","url":"https://github.com/blark/zemismart-blind-protocol","evidence_url":"https://github.com/blark/zemismart-blind-protocol/blob/547f9586e2066e573741fe0fe09ce79782ca2cf4/README.md","description_en":"Zemismart Blind Controller Protocol documents the 433.92 MHz OOK PWM messages used by Zemismart motorized blind remotes. It records pulse timing, payload fields and formulas for channel and button commands, with Python scripts to capture IQ samples and encode or decode transmissions.","description_zh":"Zemismart Blind Controller Protocol 记录 Zemismart 电动窗帘遥控器的 433.92 MHz OOK PWM 消息。文档给出脉冲时序、载荷字段以及频道和按键命令的计算公式；Python 脚本用于采集 IQ 样本和编解码发送内容。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"re4me-toolbox","name":"RE4METoolbox","name_zh":"RE4METoolbox《生化危机 4》移动版文件工具箱","url":"https://github.com/Dhamp1r/RE4ME-Toolbox","evidence_url":"https://github.com/Dhamp1r/RE4ME-Toolbox/blob/eeb3e8732d65c181d60f44a1c7051ced0be2bb8b/README.md","description_en":"RE4METoolbox provides command-line utilities for examining and modifying Resident Evil 4 Mobile Edition files. RE4MEAcvTool unpacks and repacks ACV .bin archives, while RE4METextTool converts Mission and Resource .bin text files to TSV and repacks edited text.","description_zh":"RE4METoolbox 提供命令行工具，用于处理《生化危机 4》移动版文件。RE4MEAcvTool 解包和重打包 ACV .bin 归档；RE4METextTool 将 Mission、Resource 文本 .bin 转成 TSV，并可将修改后的文本重新打包。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"ac46-firmware-tool","name":"AC46 Firmware Tool","name_zh":"AC46 Firmware Tool JieLi 固件解包工具","url":"https://github.com/0x0-nyan/AC46-Firmware-Tool","evidence_url":"https://github.com/0x0-nyan/AC46-Firmware-Tool/blob/369353c80911d9bed8d3248f72e02bda8ffd890b/README.md","description_en":"AC46 Firmware Tool unpacks firmware images for JieLi AC4600/BT15 devices. It accepts a dumped flash image or a BFU file with its first 512 bytes removed, detects an encryption state, extracts bootloader and resource files, and writes a repacking batch script. The repository also lists cipher, CRC16, and chip-key utilities.","description_zh":"AC46 Firmware Tool 用于解包 JieLi AC4600/BT15 设备固件。它读取设备闪存转储，或去掉前 512 字节的 BFU 文件，检测加密状态，提取引导程序与资源，并生成重新打包的批处理脚本。仓库还列出密码处理、CRC16 和芯片密钥工具。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"imonitor-system-activity-monitor","name":"iMonitor","name_zh":"iMonitor Windows 系统行为分析工具","url":"https://github.com/Trivexion/iMonitor-System-Activity-Monitor","evidence_url":"https://github.com/Trivexion/iMonitor-System-Activity-Monitor/blob/68d997002a64614d979b6543ec78879ba31da068/README.md","description_en":"iMonitor is a Windows endpoint activity monitor for examining running software. It records process, file, registry and network events, adds DLL-load analysis, and supports custom columns and matching rules through plugins and scripts.","description_zh":"iMonitor 是用于观察 Windows 运行中软件的系统行为工具，可记录进程、文件、注册表和网络事件，分析 DLL 加载，并通过插件和脚本扩展列及匹配规则。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"rto-echalan-android-analysis-case","name":"RTO eChalan: investigating a BankBot Android APK","name_zh":"RTO eChalan：调查 BankBot 安卓 APK","url":"https://github.com/Gautam-CyberSec/Android-Malware-Analysis-Report","evidence_url":"https://github.com/Gautam-CyberSec/Android-Malware-Analysis-Report/blob/5af85ede627d68764e7d0eed8c48d4ef548409f6/Report/Report.md","description_en":"The RTO eChalan report investigates an Android APK impersonating an Indian government eChallan service through manifest review, JADX decompilation and sandbox analysis. The author reports identifying a BankBot variant, a REQUEST_INSTALL_PACKAGES permission, a BIND_VPN_SERVICE entry and extensive obfuscation that limited decompilation.","description_zh":"RTO eChalan 报告通过检查 AndroidManifest.xml、使用 JADX 反编译及沙箱分析，调查一个冒充印度政府交通罚单服务的 APK。作者报告将其识别为 BankBot 变种，并记录了 REQUEST_INSTALL_PACKAGES 权限、BIND_VPN_SERVICE 条目及妨碍反编译的大量混淆代码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-11-06"},{"id":"m68kdasm","name":"m68kdasm","name_zh":"m68kdasm Motorola 68000 反汇编库","url":"https://github.com/jenska/m68kdasm","evidence_url":"https://github.com/jenska/m68kdasm/blob/a4de22005b19b4e05d69f710e40dad4a1fd1ae62/README.md","description_en":"m68kdasm disassembles Motorola 68000-family machine code in Go and returns assembly with structured instruction metadata. It supports selectable CPU variants, optional FPU and PMMU decoding, symbol and label formatting, streaming input and helpers for 68000 ELF binaries.","description_zh":"m68kdasm 用 Go 反汇编 Motorola 68000 系列机器码，同时输出汇编文本和结构化指令信息。它支持选择 CPU 型号、按需解码 FPU 与 PMMU 指令、符号和标签格式化、流式输入，以及 68000 ELF 文件辅助功能。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"malware-analysis-njrat-casdet-case","name":"Malware Analysis: njRAT and Casdet behavior investigation","name_zh":"Malware Analysis：njRAT 与 Casdet 行为研究","url":"https://github.com/phour44/Malware-Analysis","evidence_url":"https://github.com/phour44/Malware-Analysis/blob/c30cab3c470d81c4b6fc12b44bf3599e338a7fb8/README.md","description_en":"A malware investigation examines njRAT and a UPX-packed Casdet executable with PEStudio static triage and ANY.RUN sandbox telemetry, alongside a malicious PDF and benign comparison files. The author reports process, registry and network behavior, extracted indicators and MITRE ATT&CK mappings in a report and screenshots.","description_zh":"该恶意软件研究用 PEStudio 静态检查和 ANY.RUN 沙箱遥测分析 njRAT 与经 UPX 打包的 Casdet 可执行文件，同时检查恶意 PDF 和良性对照文件。作者在报告及截图中记录了进程、注册表、网络行为、入侵指标和 MITRE ATT&CK 映射。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary"],"verified_at":"2026-11-06"},{"id":"ir-lifting-benchmark","name":"IR Lifting Benchmark","name_zh":"IR Lifting Benchmark 二进制中间表示提升基准工具","url":"https://github.com/Prajwal-kp-18/ir-analysis","evidence_url":"https://github.com/Prajwal-kp-18/ir-analysis/blob/20cc18c2ce13422e4da6f58cd57be5c61c439406/README.md","description_en":"IR Lifting Benchmark compares binary lifting workflows across Ghidra P-code, angr VEX, BAP BIL and optional LLVM IR paths. Shell and Python scripts run analyses on binary samples, collect performance and control-flow metrics, check lifted semantics and generate reports and visualizations.","description_zh":"IR Lifting Benchmark 比较 Ghidra P-code、angr VEX、BAP BIL 及可选 LLVM IR 的二进制提升流程。Shell 与 Python 脚本分析样本、收集性能和控制流指标、检查提升后的语义，并生成报告与图表。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"claude-openocd-spi-dump","name":"OpenOCD SPI Dump Plugin","name_zh":"OpenOCD SPI Dump Plugin SPI 闪存提取向导","url":"https://github.com/lukejenkins/claude-openocd-spi-dump","evidence_url":"https://github.com/lukejenkins/claude-openocd-spi-dump/blob/08ff4c334ba5dce440042b6bd2ffe6acf77c6e2b/README.md","description_en":"OpenOCD SPI Dump Plugin guides an agent through extracting SPI flash or EEPROM contents using a target MCU's SWD/JTAG debug connection. It supplies MCU register maps, a RAM-resident C reader, linker and OpenOCD Tcl templates, and a workflow for JEDEC identification and dump checking.","description_zh":"OpenOCD SPI Dump Plugin 引导智能体经目标 MCU 的 SWD/JTAG 调试连接提取 SPI 闪存或 EEPROM 内容。仓库提供 MCU 寄存器表、驻留 RAM 的 C 读取程序、链接脚本、OpenOCD Tcl 模板，以及 JEDEC 识别和转储核对流程。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"bin-hunter","name":"Bin-Hunter","name_zh":"Bin-Hunter 二进制静态检查工具","url":"https://github.com/Emirzonee/Bin-Hunter","evidence_url":"https://github.com/Emirzonee/Bin-Hunter/blob/28d2636c9e2e67d91fbf45c672ff41f57ff8e426/README.md","description_en":"Bin-Hunter is a Python command-line tool for initial static inspection of binary files. It identifies formats from magic bytes, calculates whole-file and peak-region Shannon entropy, extracts readable strings, and finds URLs, IP addresses, email addresses, and suspicious keywords in those strings.","description_zh":"Bin-Hunter 是用于二进制文件初步静态检查的 Python 命令行工具。它通过魔数字节识别格式，计算整体及高熵区域的 Shannon 熵，提取可读字符串，并查找其中的 URL、IP 地址、邮箱和可疑关键词。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"vanmoof-certificates-case","name":"vanmoof-certificates: decoding VanMoof bike certificates","name_zh":"vanmoof-certificates：解析 VanMoof 自行车证书","url":"https://github.com/Knight1/vanmoof-certificates","evidence_url":"https://github.com/Knight1/vanmoof-certificates/blob/1d34bf3d2cc1dcad923b64d4051c224897b11b03/README.md","description_en":"vanmoof-certificates decodes the access certificates used with VanMoof SA5 and Series 6 bikes. It documents an Ed25519 signature followed by a CBOR payload containing bike serials, user identity, access role and expiry, and provides Go code to request, parse and check certificates. The source says the SA5 verification key was recovered from a bike BLE certificate.","description_zh":"vanmoof-certificates 解析 VanMoof SA5 与 Series 6 自行车使用的访问证书。文档描述了 Ed25519 签名及其后的 CBOR 载荷，包括车架与模块序列号、用户身份、权限角色和到期时间；Go 代码负责请求、解析和检查证书。项目称 SA5 验证公钥取自车辆的 BLE 证书。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"aspyr-archive-tool","name":"Aspyr Archive Tool","name_zh":"Aspyr Archive Tool Android 游戏 OBB 归档工具","url":"https://github.com/Dhamp1r/AspyrArchiveTool","evidence_url":"https://github.com/Dhamp1r/AspyrArchiveTool/blob/be0bd60ffe1f232206d0cb079a90811e60f60b34/README.md","description_en":"Aspyr Archive Tool unpacks and rebuilds Android OBB archives used by three Aspyr game ports: Star Wars: Knights of the Old Republic II, Jade Empire: Special Edition and Fahrenheit: Indigo Prophecy Remastered. Its command-line options support full or selective compression and a CRC64 checksum for Jade Empire.","description_zh":"Aspyr Archive Tool 用于拆包和重建三款 Aspyr Android 游戏移植版的 OBB 归档：Star Wars: Knights of the Old Republic II、Jade Empire: Special Edition 和 Fahrenheit: Indigo Prophecy Remastered。命令行支持完整或选择性压缩，以及 Jade Empire 所需的 CRC64 校验值。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"binaryinsight","name":"BinaryInsight","name_zh":"BinaryInsight 二进制检查工具","url":"https://github.com/ismailtsdln/BinaryInsight","evidence_url":"https://github.com/ismailtsdln/BinaryInsight/blob/bd51371e8cece9789b04fb165a37c8e0d14d8abf/README.md","description_en":"BinaryInsight inspects ELF, PE, and Mach-O executables and libraries in an interactive terminal view or a text-report CLI. Its Rust core uses goblin to parse binary structure and exposes sections, symbols, printable strings, and security mitigation indicators such as PIE, NX, RELRO, ASLR, and DEP.","description_zh":"BinaryInsight 以交互式终端界面或文本报告检查 ELF、PE、Mach-O 可执行文件和库。其 Rust 核心使用 goblin 解析文件结构，展示节、符号、可打印字符串，以及 PIE、NX、RELRO、ASLR 和 DEP 等安全缓解标志。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"scriptsource-dumper","name":"ScriptSource-Dumper","name_zh":"ScriptSource-Dumper《黑色行动 2》脚本档案提取工具","url":"https://github.com/uhhKnife/ScriptSource-Dumper","evidence_url":"https://github.com/uhhKnife/ScriptSource-Dumper/blob/c6363ad6c3cb4057a6dca03af18e86e782817d99/README.md","description_en":"ScriptSource-Dumper extracts scripts from Call of Duty: Black Ops II scriptsrc.clump archives. Its C++ parser reads the archive table of contents and data chunks, locates the internal name table, and writes files under their recovered names and directories.","description_zh":"ScriptSource-Dumper 从《使命召唤：黑色行动 2》的 scriptsrc.clump 档案提取脚本。C++ 解析器读取目录表与数据块，定位内部名称表，并按还原的文件名和目录输出内容。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"derkt","name":"derkt","name_zh":"derkt：Hermes 字节码反汇编器","url":"https://github.com/rrandom/derkt","evidence_url":"https://github.com/rrandom/derkt/blob/5a30bf97ec2d9c13f9243af6b4dc59e3290c5526/README.md","description_en":"derkt parses and disassembles Hermes Bytecode files in Racket. It decodes HBC structures and function data, detects the bytecode version and loads a matching generated instruction definition before producing disassembly. The repository includes versioned ISA definitions, parsers and a sample HBC file.","description_zh":"derkt 是 Racket 编写的 Hermes Bytecode 解析与反汇编工具。它读取 HBC 结构和函数数据，识别字节码版本，再加载对应的生成式指令定义输出反汇编。仓库包含分版本 ISA 定义、解析器和 HBC 样本。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"dragon-soul-aup-viewer","name":".AUP-File-Type-Decryptor-and-Viewer","name_zh":".AUP-File-Type-Decryptor-and-Viewer《Dragon Soul》资源查看器","url":"https://github.com/PredatorIWD/.AUP-File-Type-Decryptor-and-Viewer","evidence_url":"https://github.com/PredatorIWD/.AUP-File-Type-Decryptor-and-Viewer/blob/8ccbc8e6c288584b55fbd63fa66173bc3e1105c5/README.md","description_en":".AUP-File-Type-Decryptor-and-Viewer is a local browser tool for inspecting Dragon Soul .aup game asset files. It implements the documented LZSS variant, previews image, audio and text formats, and exports files while preserving folder structure. The README specifies the four-byte size header and ring-buffer command stream.","description_zh":".AUP-File-Type-Decryptor-and-Viewer 是本地浏览器工具，用于查看《Dragon Soul》的 .aup 游戏资源文件。它实现文档所述的 LZSS 变体，可预览图像、音频和文本，并按原有目录结构导出文件。README 还说明了四字节长度头与环形缓冲命令流。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"odis-file-unpacker","name":"ODIS file unpacker","name_zh":"ODIS file unpacker ODIS 文件解包工具","url":"https://github.com/kartoffelpflanze/ODIS-file-unpacker","evidence_url":"https://github.com/kartoffelpflanze/ODIS-file-unpacker/blob/f2408cd2d9dbf4a812ccab058c5836598773fddd/README.md","description_en":"ODIS file unpacker extracts protected Java classes from ODIS plugin JARs and files from its DIDB data archives. The author traces AES class decryption and Blowfish ECB data decryption through debugging, a Java agent and decompiled class code; some extracted files also require GZIP decompression.","description_zh":"ODIS file unpacker 从 ODIS 插件 JAR 中提取受保护的 Java 类，并解包 DIDB 数据。作者通过调试、Java 代理程序和反编译后的类代码定位 AES 类解密及 Blowfish ECB 数据解密；部分文件还需 GZIP 解压。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"rust-sig-gen","name":"rust-sig-gen","name_zh":"rust-sig-gen Rust crate 的 IDA 签名生成器","url":"https://github.com/st0de/rust-sig-gen","evidence_url":"https://github.com/st0de/rust-sig-gen/blob/8890d961aa966531525393774b257a797e59a61d/README.md","description_en":"rust-sig-gen generates IDA FLAIR library signatures from compiled Rust crates for executable analysis. Its Python script obtains the top 100 crates, builds them for Linux and x86-64 Windows, and processes the outputs with sigmake, pelf and pcf.","description_zh":"rust-sig-gen 为可执行文件分析生成 Rust crate 的 IDA FLAIR 库签名。其 Python 脚本获取排名前 100 的 crate，编译 Linux 与 x86-64 Windows 版本，再使用 sigmake、pelf 和 pcf 处理编译产物。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"tmock-server-case","name":"tMock-Server: reconstructing Terraria server handshakes","name_zh":"tMock-Server：重建 Terraria 服务器握手流程","url":"https://github.com/StardustVulpine/tMock-Server","evidence_url":"https://github.com/StardustVulpine/tMock-Server/blob/54cbdba0337979fe4d67e4f2e613a6f0d0811345/README.md","description_en":"tMock-Server is an unfinished C++ reimplementation of the Terraria server's initial network flow. It uses socket code and packet classes to accept connections, check protocol versions, request passwords, and assign player slots; the README records packet IDs, fields, directions, and structures informed by traffic analysis.","description_zh":"tMock-Server 是用 C++ 重建 Terraria 服务器初始联网流程的未完成项目。它以套接字代码和数据包类处理连接、协议版本、密码交换及玩家槽位分配；README 根据流量分析记录了消息 ID、字段、方向和结构。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game","protocol"],"verified_at":"2026-11-06"},{"id":"1cmdparser","name":"1C 7.7 Configuration Parser (MD Parser)","name_zh":"1C 7.7 Configuration Parser 1C 配置文件解析器","url":"https://github.com/bigsprut/1CMDParser","evidence_url":"https://github.com/bigsprut/1CMDParser/blob/bcf43b4538af56557d190c0bdd2871de3ba097b2/readme.md","description_en":"1C 7.7 Configuration Parser inspects 1C:Enterprise 7.7 1cv7.md configuration containers. Its Win32 interface displays OLE streams, decompresses ZLib data, removes the documented XOR layer and parses Main MetaData Stream into an object hierarchy.","description_zh":"1C 7.7 Configuration Parser 检查 1C:Enterprise 7.7 的 1cv7.md 配置容器。其 Win32 界面展示 OLE 流，解压 ZLib 数据、去除文档所述的 XOR 加密层，并将 Main MetaData Stream 解析为对象层级。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"x64dbg-tenet","name":"x64dbg-tenet","name_zh":"x64dbg-tenet Tenet 格式轨迹录制插件","url":"https://github.com/gr0grig/x64dbg-tenet","evidence_url":"https://github.com/gr0grig/x64dbg-tenet/blob/4ed0c58eb8df75b9022b9ecc4cdd06422bad0e0b/README.md","description_en":"x64dbg-tenet is a native x64dbg plugin that records execution steps in Tenet trace format. Commands start and stop logging or trace a specified number of steps, with an option to stop when execution leaves the current module.","description_zh":"x64dbg-tenet 是将执行步骤录制为 Tenet 轨迹格式的原生 x64dbg 插件。命令可启动和停止记录，也可追踪指定步数，或在执行离开当前模块时停止。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"vanmoof-ble-protocol-case","name":"VanMoof BLE: a client for S5, A5 and S6 bicycle protocols","name_zh":"VanMoof BLE：S5、A5 与 S6 自行车协议客户端","url":"https://github.com/Knight1/vanmoof-ble","evidence_url":"https://github.com/Knight1/vanmoof-ble/blob/173b4c4fdf77b9f47d0aeea1f9ee1379e2aa0e92/docs/PROTOCOL.md","description_en":"VanMoof BLE implements a Python client for the S5, A5 and S6 bicycle BLE protocols. It authenticates with an Ed25519 certificate, reads and writes documented topics, decodes captured messages, and exposes controls and telemetry according to each model's message format.","description_zh":"VanMoof BLE 用 Python 实现 VanMoof S5、A5 和 S6 自行车的 BLE 协议客户端。它使用 Ed25519 证书认证，读写文档化的主题、解码抓取的消息，并按不同车型的消息格式提供控制与遥测功能。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","protocol"],"verified_at":"2026-11-06"},{"id":"holley-efi-parser","name":"Holley EFI Parser","name_zh":"Holley EFI Parser 日志与 CAN 协议解析工具","url":"https://github.com/HackingLZ/holley-efi-parser","evidence_url":"https://github.com/HackingLZ/holley-efi-parser/blob/3403b0446a6a843be8be03a449a8e00e25810964/README.md","description_en":"Holley EFI Parser decodes Holley DL and DLZ data logs and live ECU CAN messages. Its Python tools decompress DLZ with byte swapping and RLE, parse versioned DL records into pandas DataFrames, and decode CAN messages using supplied DBC files. The documentation records the proprietary 29-bit CAN identifier layout.","description_zh":"Holley EFI Parser 解析 Holley 的 DL、DLZ 数据日志及 ECU 实时 CAN 消息。Python 工具通过字节交换和 RLE 解压 DLZ，将不同版本的 DL 记录读入 pandas DataFrame，并用附带的 DBC 文件解码 CAN；文档还记录了专有的 29 位 CAN 标识符结构。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"vanmoof-can-bus-parser","name":"CAN Bus Parser","name_zh":"CAN Bus Parser VanMoof 总线解析工具","url":"https://github.com/Knight1/vanmoof-canbus","evidence_url":"https://github.com/Knight1/vanmoof-canbus/blob/9a7428748e4307405b16fe95565aa23033a07a1d/README.md","description_en":"CAN Bus Parser decodes VanMoof SA5 and later bicycle CAN captures from CSV or candump input. It reassembles multi-frame CBOR messages, maps device IDs and heartbeat frames, and provides live or saved-capture diagnostics for components such as the electronic lock and shifter.","description_zh":"CAN Bus Parser 解析 VanMoof SA5 及后续车型的 CSV 或 candump CAN 抓包，重组多帧 CBOR 消息并映射设备 ID 与心跳帧。它还可对电子锁、变速器等组件进行实时或离线诊断。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"cosmic-byte-firestorm-controller-case","name":"Cosmic Byte Firestorm Controller: a USB protocol client for mouse settings","name_zh":"Cosmic Byte Firestorm Controller：基于 USB 协议的鼠标设置客户端","url":"https://github.com/electrondefuser/cbfirestorm","evidence_url":"https://github.com/electrondefuser/cbfirestorm/blob/65802f360916030cffa2207ac5f72fae183fe0ca/README.md","description_en":"Cosmic Byte Firestorm Controller implements a Linux client for the mouse's recovered USB settings protocol. Its Python CLI sends control and interrupt transfers to configure lighting effects, per-DPI indicator colours and sensitivity levels, while PROTOCOL.md records packet structures and command sequences.","description_zh":"Cosmic Byte Firestorm Controller 是基于已解析 USB 设置协议实现的 Linux 鼠标控制工具。其 Python 命令行程序通过控制传输和中断传输配置灯效、各档 DPI 指示颜色及灵敏度；PROTOCOL.md 记录了数据包结构和命令序列。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"nuvelocity-engine-case","name":"NuVelocity Engine: reimplementing Reflexive's Velocity Engine","name_zh":"NuVelocity Engine：重实现 Reflexive 的 Velocity Engine","url":"https://github.com/NuVelocity/NuVelocity","evidence_url":"https://github.com/NuVelocity/NuVelocity/blob/814f9c879de343bd57b5d875dc9119eb57496269/README.md","description_en":"NuVelocity Engine reimplements Reflexive Entertainment's Velocity Engine as a C++ and SDL3 game engine. It provides modular 2D rendering, asset and resource loading, audio playback, screen management, and a property-based object system, with decoder source included in the repository.","description_zh":"NuVelocity Engine 用 C++ 和 SDL3 重实现 Reflexive Entertainment 的 Velocity Engine。它包含模块化二维渲染、资源加载、音频播放、界面管理和基于属性的对象系统，仓库中还提供资源解码器源码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"freers42-ricochet-xtreme-case","name":"FreeRS42: reimplementing Ricochet Xtreme","name_zh":"FreeRS42：重实现《Ricochet Xtreme》","url":"https://github.com/NuVelocity/FRS42","evidence_url":"https://github.com/NuVelocity/FRS42/blob/8d006fbe0d64663830590d23c0519c34d5f4a3ed/README.md","description_en":"FreeRS42 is a C++ project to reimplement the PC game Ricochet Xtreme using the NuVelocity engine. The repository contains source for game objects, playfield behavior and screens, with a CMake build that includes the engine submodule.","description_zh":"FreeRS42 是使用 NuVelocity 引擎、以 C++ 重现 PC 游戏《Ricochet Xtreme》的项目。仓库包含游戏对象、场地逻辑和界面的源码，并通过 CMake 构建游戏及引擎子模块。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"universal-gba-pokedex","name":"Universal GBA Pokedex","name_zh":"Universal GBA Pokedex 宝可梦 ROM 数据分析工具","url":"https://github.com/TheJazz123/Universal-GBA-Pokedex","evidence_url":"https://github.com/TheJazz123/Universal-GBA-Pokedex/blob/71e18741b740d0ae2e4320035e6bb207c6ffd26e/README.md","description_en":"Universal GBA Pokedex scans Game Boy Advance Pokémon ROMs to locate and display evolution, name and item tables. It searches byte signatures, scores candidate tables using text and pointer patterns, and aligns entries against known anchors instead of requiring fixed offsets.","description_zh":"Universal GBA Pokedex 扫描 Game Boy Advance 宝可梦 ROM，定位并展示进化、名称和道具表。它搜索字节特征，依据文本及指针模式评分候选表，再用已知条目对齐索引，无需预设固定偏移。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"nullsec-bingaze","name":"NullSec BinGaze","name_zh":"NullSec BinGaze ELF 结构与防护属性分析工具","url":"https://github.com/bad-antics/nullsec-bingaze","evidence_url":"https://github.com/bad-antics/nullsec-bingaze/blob/91848d3db19fa7388264825312720c1b0717d2c7/README.md","description_en":"NullSec BinGaze analyses ELF executables by parsing headers, listing sections and calculating entropy. It also reports NX stack, PIE, RELRO, stack-canary and RWX-segment properties through command-line modes for full analysis, section listing or security assessment.","description_zh":"NullSec BinGaze 通过解析 ELF 头、列出节区和计算熵来分析可执行文件。命令行提供完整分析、节区列表和安全属性检查，可报告 NX 栈、PIE、RELRO、栈保护及 RWX 段。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"finalmouse-centerpiece-protocol-case","name":"Centerpiece Projects: decoding Finalmouse Centerpiece USB control","name_zh":"Centerpiece Projects：解析 Finalmouse Centerpiece 的 USB 控制协议","url":"https://github.com/LeiterConsulting/finalmouse_centerpiece","evidence_url":"https://github.com/LeiterConsulting/finalmouse_centerpiece/blob/ecd36e48f7a540dc9c723da32fbb03782de480a7/gitdocs/ProtocolNotes.md","description_en":"Centerpiece Projects documents observed USB control messages for the Finalmouse Centerpiece keyboard and implements scripts around them. Its notes describe HID framing and message types for uploads, status, slot switching and preview chunks; PowerShell and Python helpers expose device operations.","description_zh":"Centerpiece Projects 记录 Finalmouse Centerpiece 键盘的 USB 控制消息，并据此编写交互脚本。协议笔记描述 HID 帧结构，以及上传、状态、槽位切换和预览分块的消息类型；PowerShell 与 Python 工具提供相应操作。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"facebookcodec","name":"Facebook BitMap Codec","name_zh":"Facebook BitMap Codec 参数编解码工具","url":"https://github.com/NiceDayZc/FacebookCodec","evidence_url":"https://github.com/NiceDayZc/FacebookCodec/blob/035ad8cd386f6c5a102f0d4ca303ae62e5434f6b/README.md","description_en":"Facebook BitMap Codec encodes and decodes Facebook web API parameter values using the project's reverse-engineered bitmap, run-length and custom Base64 scheme. Its Python module exposes a FacebookCodec class for converting ID lists to encoded strings and back across parameters including __dyn and __csr.","description_zh":"Facebook BitMap Codec 按项目还原的位图、游程编码和自定义 Base64 规则，对 Facebook 网页 API 参数进行编解码。Python 模块提供 FacebookCodec 类，可在 ID 列表与 __dyn、__csr 等参数值之间转换。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-11-06"},{"id":"pdbinspector","name":"pdbinspector","name_zh":"pdbinspector Microsoft PDB 信息检查工具","url":"https://github.com/nikaiw/pdbinspector","evidence_url":"https://github.com/nikaiw/pdbinspector/blob/c02a188fdefd98bfca7583561cad0e9f7486b902/README.md","description_en":"pdbinspector analyzes Microsoft PDB files to list structures, classes, enums, functions, public symbols and exports. It demangles MSVC C++ names, decodes MSVC string literals and emits text, JSON or tab-separated reports through a CLI; a WebAssembly version runs online.","description_zh":"pdbinspector 分析 Microsoft PDB 文件，列出结构体、类、枚举、函数、公共符号和导出项。它可还原 MSVC C++ 符号名、解码 MSVC 字符串字面量，并通过命令行输出文本、JSON 或制表符分隔报告；另有 WebAssembly 在线版本。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"ac3-online-service-docs","name":"Assassin's Creed III online service docs","name_zh":"Assassin's Creed III 在线服务协议文档","url":"https://github.com/Phoenix-Assassins/ac3-docs","evidence_url":"https://github.com/Phoenix-Assassins/ac3-docs/blob/10ab3f025e60d0473a594bb1d9bc0ed971ac2a67/RMC/ACOnlineSaveProtocol.md","description_en":"Assassin's Creed III online service docs record method IDs and request and response fields for the PC game's online services. The files cover RMC services such as online saves and account management, alongside notes on P2P Duplicated Objects over PRUDP.","description_zh":"Assassin's Creed III 在线服务文档记录 PC 版游戏服务的方法编号，以及请求和响应字段。现有文件涵盖在线存档、账户管理等 RMC 服务，并记载 PRUDP 上的 P2P Duplicated Objects。","kind":"documentation","category":"protocol-analysis","group":"learn","relationship":"learning","targets":["game","protocol"],"verified_at":"2026-11-06"},{"id":"aol7-retro-server-case","name":"AOL 7.0 Retro Server: reconstructing the P3 server session","name_zh":"AOL 7.0 Retro Server：复现 P3 服务端会话","url":"https://github.com/pioneerman2k1/AOL7-Retro-Server","evidence_url":"https://github.com/pioneerman2k1/AOL7-Retro-Server/blob/fe9a0a27ac76c459181d268f51a98a4df0438f03/README.md","description_en":"AOL 7.0 Retro Server implements local Python servers for the 2001 AOL 7.0 client. It reconstructs the proprietary P3 login and security exchange, the handoff between login and BOS servers, and post-login data used to display the welcome screen and buddy list.","description_zh":"AOL 7.0 Retro Server 为 2001 年的 AOL 7.0 客户端实现本地 Python 服务端。它复现专有 P3 登录与安全握手、登录服务器到 BOS 服务器的切换，以及显示欢迎页和好友列表所需的登录后数据。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-11-06"},{"id":"vainglory-replay-decoder","name":"VG Reverse Engineering","name_zh":"VG Reverse Engineering Vainglory 回放分析工具","url":"https://github.com/TurnaboutHero/vainglory-replay-decoder","evidence_url":"https://github.com/TurnaboutHero/vainglory-replay-decoder/blob/f4743be743564e3aadef1566499fe25d9d0f9ffc/README.md","description_en":"VG Reverse Engineering decodes Vainglory: Community Edition replay files into recorded player names, heroes, K/D/A, items, gold and scoreboard counters. Its offline tools also export JSON and CSV, maintain a SQLite catalog and document VGR record and event interpretation. Output records provenance and leaves unsupported values unresolved.","description_zh":"VG Reverse Engineering 将 Vainglory: Community Edition 回放文件解码为玩家名称、英雄、击杀／死亡／助攻统计、物品、金币和计分板计数。离线工具还可导出 JSON、CSV，维护 SQLite 目录，并记录 VGR 记录结构与事件解释；输出保留数据来源，对缺少依据的数值保持空值。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"8086-register-command-debugger","name":"8086 Register Command Debugger","name_zh":"8086 Register Command Debugger 汇编调试器","url":"https://github.com/Usman-Azfar/8086-assembly-debugger","evidence_url":"https://github.com/Usman-Azfar/8086-assembly-debugger/blob/a35fca10b5483212307bb3fb02dc7bc4d23c88fe/README.md","description_en":"8086 Register Command Debugger is an MS-DOS machine-code inspection tool written in 8086 assembly. It loads a program into a 64 KB segment, decodes 8086 instructions and lets users inspect or edit memory and registers while stepping through real CPU instructions using the Trap Flag.","description_zh":"8086 Register Command Debugger 是以 8086 汇编编写的 MS-DOS 机器码分析工具。它把程序装入 64 KB 段，反汇编 8086 指令，供用户查看和修改内存、寄存器，并借助 Trap Flag 逐条执行真实 CPU 指令。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"ac4-docs","name":"AC4 docs","name_zh":"AC4 docs《刺客信条 IV：黑旗》在线服务协议文档","url":"https://github.com/Phoenix-Assassins/ac4-docs","evidence_url":"https://github.com/Phoenix-Assassins/ac4-docs/blob/5db849b7df9ca7a4f71c9059c02d045f99568169/RMC/ACOnlineSaveProtocol.md","description_en":"AC4 docs records online service interfaces for the PC version of Assassin's Creed IV Black Flag. Its RMC documents list method IDs and request and response types, while the repository also contains HTTP API specifications for service revival work.","description_zh":"AC4 docs 记录《刺客信条 IV：黑旗》PC 版在线服务接口。RMC 文档列出方法编号及请求、响应类型；仓库还收录 HTTP API 规格，供在线服务恢复工作参考。","kind":"documentation","category":"protocol-analysis","group":"learn","relationship":"learning","targets":["game","protocol"],"verified_at":"2026-11-06"},{"id":"devlens-ultra","name":"DevLens Ultra","name_zh":"DevLens Ultra 网页组件分析扩展","url":"https://github.com/Arsh-pixel-cmd/DevLens","evidence_url":"https://github.com/Arsh-pixel-cmd/DevLens/blob/bf2b4ed21cb79aa2713cc4917ff06ea415431332/README.md","description_en":"DevLens Ultra is a Chrome extension for inspecting and extracting website component structure. It analyzes selected DOM elements, computed styles and framework state such as React Fiber props, then generates React JSX and Tailwind classes. An optional AI step refines selected snippets through a configured provider.","description_zh":"DevLens Ultra 是用于检查和提取网页组件结构的 Chrome 扩展。它分析所选 DOM 元素、计算样式及 React Fiber 属性等框架状态，生成 React JSX 与 Tailwind 类；用户还可配置 AI 服务进一步整理所选片段。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-11-06"},{"id":"faac-e145-gate-connect-case","name":"FAAC E145 Gate Connect: reconstructing EasyBoard gate commands","name_zh":"FAAC E145 Gate Connect：重建 EasyBoard 门机命令","url":"https://github.com/jens62/FAAC-E145-Gate-Connect","evidence_url":"https://github.com/jens62/FAAC-E145-Gate-Connect/blob/631e8b03b92746234cf5470f6080b3e800f9f9d1/docs/installation.md","description_en":"FAAC E145 Gate Connect implements local control of an FAAC E145 gate through serial commands reconstructed from EasyBoard software traffic. The documentation lists POLL, OPEN, CLOSE and STOP byte sequences and describes their framing and checksum. The Python gateway adds position monitoring plus web, REST and MQTT interfaces.","description_zh":"FAAC E145 Gate Connect 使用从 EasyBoard 软件通信中还原的串口命令，本地控制 FAAC E145 门机。文档列出 POLL、OPEN、CLOSE、STOP 的字节序列，并解释帧结构和校验字段。Python 网关还提供位置监控、网页、REST 与 MQTT 接口。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"stagg-net-case","name":"stagg-net: investigating the Fellow Stagg EKG kettle UART","name_zh":"stagg-net：Fellow Stagg EKG 电水壶 UART 接口调查","url":"https://github.com/linux4life798/stagg-net","evidence_url":"https://github.com/linux4life798/stagg-net/blob/d0592047e340172d0bb90415f2717894b516f2cb/README.md","description_en":"stagg-net investigates the Fellow Stagg EKG kettle's internal UART interface and documents its connector, serial settings, observed heartbeat packet, and startup message. The repository includes a logic capture, decoder source, probing scripts, and ESPHome configuration for an ESP32-C6 connection.","description_zh":"stagg-net 调查 Fellow Stagg EKG 电水壶的内部 UART 接口，记录连接器、串口参数、周期心跳包和启动消息。仓库还提供逻辑分析采集文件、解码源码、探测脚本和用于 ESP32-C6 的 ESPHome 配置。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"malware-analysis-cti-reports","name":"Malware Analysis & CTI Reports","name_zh":"Malware Analysis & CTI Reports 恶意软件分析报告集","url":"https://github.com/Spellskite-coding/Binary_Analysis","evidence_url":"https://github.com/Spellskite-coding/Binary_Analysis/blob/b247a3fbdc35199f7d83d60f38db08a0c51a8540/README.md","description_en":"Malware Analysis & CTI Reports collects ten PDF investigations of malware, security tools and binaries with disputed detections. The author describes static inspection with Detect It Easy, strings and imports, followed by manual disassembly or decompilation in Ghidra or radare2.","description_zh":"Malware Analysis & CTI Reports 收录十篇 PDF 调查，涉及恶意软件、安全工具及检测结果存疑的二进制文件。作者采用 Detect It Easy、字符串和导入表检查，并使用 Ghidra 或 radare2 人工反汇编、反编译。","kind":"collection","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-11-06"},{"id":"advantage","name":"advantage","name_zh":"advantage Lenovo Vantage RPC 分析工具","url":"https://github.com/rtfmkiesel/advantage","evidence_url":"https://github.com/rtfmkiesel/advantage/blob/fd75e9cccf1acbf845be81c42acfa6cefd430665/README.md","description_en":"advantage is a Windows research tool for inspecting Lenovo Vantage and add-in RPC commands. It injects a stub into a Lenovo-signed process, supplies an RPC JSON payload from a local server, and returns the command response through a CLI or web interface; the repository also contains Frida contract and request dump scripts.","description_zh":"advantage 用于检查 Lenovo Vantage 及其插件的 RPC 命令。它把存根注入 Lenovo 签名进程，从本地服务器提供 RPC JSON 请求，并通过命令行或网页界面返回响应；仓库还包含导出契约和请求的 Frida 脚本。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"chip8-emulator-disassembler","name":"Chip-8 Emulator and c8-disassembler","name_zh":"Chip-8 Emulator 与 c8-disassembler 反汇编器","url":"https://github.com/lem2clide/Chip8-Emulator","evidence_url":"https://github.com/lem2clide/Chip8-Emulator/blob/a863770a6fea6f673357e4836c189ee63f63eb50/README.md","description_en":"The c8-disassembler in Chip-8 Emulator translates CHIP-8 ROM opcodes into assembly instructions. Its source and sample Pong ROM listing show the supported output; the repository also contains a companion emulator whose SDL2 display is marked as work in progress.","description_zh":"Chip-8 Emulator 中的 c8-disassembler 将 CHIP-8 ROM 操作码转换为汇编指令。仓库提供源码及 Pong ROM 的输出示例；配套模拟器的 SDL2 显示功能仍在开发。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"erepublik-api-documentation","name":"eRepublik API Documentation","name_zh":"eRepublik API Documentation 网页客户端接口资料","url":"https://github.com/driversti/erepublik-api","evidence_url":"https://github.com/driversti/erepublik-api/blob/e6f89df77da4a22888233a957a012189552718e8/README.md","description_en":"eRepublik API Documentation maps endpoints observed in the browser-based strategy game's web client. Its reference pages cover authentication cookies and requests for travel, battles, economy, social features and other game functions, with HTTP methods and example parameters.","description_zh":"eRepublik API Documentation 整理从网页策略游戏客户端观察到的接口。文档记录认证 Cookie，以及旅行、战斗、经济和社交等功能的请求路径、HTTP 方法与参数示例。","kind":"documentation","category":"web-analysis","group":"learn","relationship":"learning","targets":["game","website"],"verified_at":"2026-11-06"},{"id":"garmin-strength-workout-api","name":"Garmin Strength Workout API","name_zh":"Garmin Strength Workout API 力量训练接口参考","url":"https://github.com/n1t3k/garmin-strength-api","evidence_url":"https://github.com/n1t3k/garmin-strength-api/blob/20aabbcb15598f67794e29938e2d87d0d22861c9/README.md","description_en":"Garmin Strength Workout API documents payloads for creating strength workouts through Garmin Connect's undocumented API. Its reference describes repeat groups, exercise and rest steps, conditions, weights and exercise identifiers, with JSON examples plus a small builder and validator.","description_zh":"Garmin Strength Workout API 记录了通过 Garmin Connect 未公开接口创建力量训练的请求结构。参考资料说明重复组、动作与休息步骤、条件、重量和动作标识，并附 JSON 示例及简单的生成与校验工具。","kind":"documentation","category":"web-analysis","group":"learn","relationship":"learning","targets":["protocol","website"],"verified_at":"2026-11-06"},{"id":"netdumper","name":"netdumper","name_zh":"netdumper .NET 程序集内存提取工具","url":"https://github.com/coconutbird/netdumper","evidence_url":"https://github.com/coconutbird/netdumper/blob/c7ffe79e3afe804868ed61f2d335c4f173d047e3/README.md","description_en":"netdumper extracts loaded .NET assemblies from Windows processes through the CLR Data Access Component. It enumerates AppDomains and assemblies, recovers JIT method IL, converts memory layouts to PE files, and repairs damaged PE headers or metadata streams for subsequent inspection.","description_zh":"netdumper 通过 CLR Data Access Component 从 Windows 进程中提取已加载的 .NET 程序集。它枚举 AppDomain 与程序集，恢复 JIT 方法的 IL，将内存布局转换为 PE 文件，并修复受损的 PE 头或元数据流以供分析。","kind":"tool","category":"dotnet","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"tozo-control-case","name":"TOZO Control: a Linux earbuds client built from the TOZO BLE protocol","name_zh":"TOZO Control：基于 TOZO BLE 协议的 Linux 耳机客户端","url":"https://github.com/GabriWar/tozo-control","evidence_url":"https://github.com/GabriWar/tozo-control/blob/eb40bdf22203078aa635e8c61d960538f679cfab/README.md","description_en":"TOZO Control provides a Linux GTK4 client for TOZO earbuds using a BLE GATT protocol recovered from the vendor's Android app. It sends commands to characteristic B611, receives notifications on B612, and documents GET and SET packet layouts and parameter IDs. The author reports testing the T10 model for battery, game mode, equalizer and balance controls.","description_zh":"TOZO Control 是 Linux GTK4 耳机客户端，使用从 TOZO Android 应用逆向得到的 BLE GATT 协议。它向 B611 特征写入命令，从 B612 接收通知，并记录 GET、SET 数据包结构及参数编号。作者报告已在 T10 上测试电量、游戏模式、均衡器和声道平衡功能。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"bms-rs485-service-suite-case","name":"BMS RS485 Service Suite: reconstructing a battery-service bus protocol","name_zh":"BMS RS485 Service Suite：重建电池管理总线协议","url":"https://github.com/zonfacter/bms-rs485-service-suite","evidence_url":"https://github.com/zonfacter/bms-rs485-service-suite/blob/14e1a759e7315c29d1dd1ec2b292dfd5c4d78d63/docs/PROTOCOL_RS485_1363.md","description_en":"BMS RS485 Service Suite documents an observed ASCII RS485 protocol for battery-management services and implements frame building and decoding in Node-RED. The specification covers framing, length and checksum fields, request and response rules and decoded service IDs; the wider suite connects JK and DALY BLE data to MQTT and dashboards.","description_zh":"BMS RS485 Service Suite 记录电池管理服务中观察到的 ASCII RS485 协议，并在 Node-RED 中实现构帧与解码。规格涵盖帧结构、长度与校验字段、请求响应规则及已解析的服务编号；套件还将 JK、DALY 的 BLE 数据接入 MQTT 和仪表板。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"bgi-ethornell-converter-tga","name":"BGI Converter TGA","name_zh":"BGI Converter TGA Ethornell 图像格式分析与转换工具","url":"https://github.com/yutaro023/BGI-Ethornell_ConverterTGA_Sekai_VN","evidence_url":"https://github.com/yutaro023/BGI-Ethornell_ConverterTGA_Sekai_VN/blob/2b785515ce91f42845a4d36e61cd509affde5fe6/README.md","description_en":"BGI Converter TGA analyzes BGI-Ethornell game image files and converts custom RGB or RGBA layouts and BMP images into 32-bit TGA. Its C++17 utility detects formats from headers, reports dimensions and offsets, and supports single-file or batch conversion.","description_zh":"BGI Converter TGA 分析 BGI-Ethornell 游戏图像文件，将自定义 RGB、RGBA 布局及 BMP 图像转换为 32 位 TGA。该 C++17 工具按文件头识别格式，显示尺寸和偏移信息，并支持单文件或批量转换。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"valkyrie-malware-analyzer","name":"Valkyrie","name_zh":"Valkyrie 恶意程序分析工具","url":"https://github.com/rifatardarslan/Valkyrie","evidence_url":"https://github.com/rifatardarslan/Valkyrie/blob/eab7e5e3c47c9d15ca53e80e3a32913a5287d714/README.md","description_en":"Valkyrie analyzes suspect binaries through static inspection and Docker-based execution. Its documented pipeline examines PE headers, entropy and packing, then captures system calls, file activity and PCAP traffic for reports and threat-intelligence output.","description_zh":"Valkyrie 通过静态检查和 Docker 执行环境分析可疑二进制文件。文档所述流程检查 PE 头、熵和加壳，并采集系统调用、文件活动及 PCAP 流量，生成分析和威胁情报报告。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"pe-disassembler-ddeeduck","name":"PE Disassembler","name_zh":"PE Disassembler x86 PE 反汇编工具","url":"https://github.com/ddeeduck/Pe-disassembler","evidence_url":"https://github.com/ddeeduck/Pe-disassembler/blob/089a567c3a9561178d8785b7ea85f1d73bfaeb98/README.md","description_en":"PE Disassembler is a WPF application that extracts the .text section of 32-bit Windows PE executables and displays decoded x86 instructions. It checks MZ and PE signatures, handles a limited set of movement, arithmetic and control-flow opcodes, and can save the listing as text.","description_zh":"PE Disassembler 是一款 WPF 程序，从 32 位 Windows PE 可执行文件的 .text 节提取并显示 x86 指令。它检查 MZ 和 PE 签名，解码有限的传送、算术与控制流指令，并可保存文本清单。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"sicxe-disassembler","name":"SIC/XE Disassembler and Linking Loader","name_zh":"SIC/XE Disassembler and Linking Loader 反汇编与链接装载工具","url":"https://github.com/MN294/SICXE-Disassembler","evidence_url":"https://github.com/MN294/SICXE-Disassembler/blob/60726b6bc7337081c2582581f6d3a429363a298b/README.md","description_en":"SIC/XE Disassembler and Linking Loader converts SIC/XE object code into assembly listings and reconstructed symbols. Its first pass identifies instruction boundaries and addressing modes; its second emits assembly, while a separate loader resolves external symbols and applies relocation records.","description_zh":"SIC/XE Disassembler and Linking Loader 将 SIC/XE 目标代码转换为汇编清单与重建的符号表。第一遍识别指令边界和寻址方式，第二遍输出汇编；另有链接装载器解析外部符号并处理重定位记录。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"xenus-dt1-decompiler","name":"Xenus DT1 Decompiler","name_zh":"Xenus DT1 Decompiler 游戏纹理缓存解码器","url":"https://github.com/CodeNoob53/xenus-dt1-decompiler","evidence_url":"https://github.com/CodeNoob53/xenus-dt1-decompiler/blob/fcf0458fe31f9c94f531ae06b39d6a6ad8b71ae4/README.md","description_en":"Xenus DT1 Decompiler extracts DT1 and DT2 texture caches from Xenus 2: White Gold and Boiling Point: Road to Hell; its current decoder has not been tested with The Precursors. Its C# decoder reimplements behavior recovered from VELoader.dll, handles zlib and UCL NRV2E streams, and exports DDS or converted image formats.","description_zh":"Xenus DT1 Decompiler 可提取 Xenus 2: White Gold 和 Boiling Point: Road to Hell 的 DT1/DT2 纹理缓存；当前解码器尚未在 The Precursors 上测试。其 C# 解码器重实现了从 VELoader.dll 还原的处理流程，可处理 zlib 和 UCL NRV2E 数据流，并导出 DDS 或转换后的图像格式。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"lutron-protocols","name":"Lutron Protocols","name_zh":"Lutron Protocols 路创通信协议研究","url":"https://github.com/alxgmpr/lutron-protocols","evidence_url":"https://github.com/alxgmpr/lutron-protocols/blob/d4e0a00547ac27b01ea7053bb6d190e9caa6aa6c/README.md","description_en":"Lutron Protocols researches CCA radio packets, CCX Thread and CoAP messages, the LEAP processor API and IPL Designer integration frames for Lutron lighting systems. Its documentation covers device behavior and firmware, while TypeScript tools capture and decode traffic and parse Designer project files.","description_zh":"Lutron Protocols 研究路创照明系统的 CCA 无线报文、CCX Thread 与 CoAP 消息、LEAP 处理器 API，以及 IPL Designer 集成帧。仓库记录设备与固件分析，并提供 TypeScript 工具用于抓取和解码流量、解析 Designer 项目文件。","kind":"project","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","binary","firmware","protocol"],"verified_at":"2026-11-06"},{"id":"steelseries-overlay-hook-case","name":"SteelSeries Overlay Hook: mapping and hooking the GameOverlay swapchain","name_zh":"SteelSeries Overlay Hook：解析并挂钩 GameOverlay 交换链","url":"https://github.com/meowdiocre/ss-overlay-hook","evidence_url":"https://github.com/meowdiocre/ss-overlay-hook/blob/30de968b1549eb7cc22ef7b7245d6a87e64b0419/hook/README.md","description_en":"SteelSeries Overlay Hook documents IDA analysis of SteelSeriesGameOverlay.dll’s window, object layout and Direct3D 11 swapchain, then uses recovered offsets in a C++ DLL hook. Its injector and hook render Dear ImGui content through the existing GameOverlay window by intercepting Present and ResizeBuffers.","description_zh":"SteelSeries Overlay Hook 记录了用 IDA 分析 SteelSeriesGameOverlay.dll 的窗口、对象布局和 Direct3D 11 交换链，并在 C++ DLL 钩子中使用恢复的偏移。配套注入器通过拦截 Present 和 ResizeBuffers，在现有 GameOverlay 窗口中绘制 Dear ImGui 内容。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","binary"],"verified_at":"2026-11-06"},{"id":"sandwitcher","name":"Sandwitcher","name_zh":"Sandwitcher Android ART 方法钩子库","url":"https://github.com/IR0NBYTE/Sandwitcher","evidence_url":"https://github.com/IR0NBYTE/Sandwitcher/blob/48f73f26dbcecadb5d71c2993a384e2172fa564f/README.md","description_en":"Sandwitcher instruments Java and Kotlin method calls in Android apps by replacing ART method entry points with a trampoline through Pine and LSPlant. Its AAR exposes callbacks before and after the original call to inspect or change arguments and results and inspect thrown exceptions; it also includes a demo application.","description_zh":"Sandwitcher 通过 Pine 和 LSPlant 在运行时以跳板替换 ART 方法入口，对 Android 应用中的 Java 和 Kotlin 方法调用进行插桩。其 AAR 提供原方法调用前后的回调，可检查或修改参数与返回结果、查看抛出的异常，并附有演示应用。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"bin-xray","name":"Bin X-ray","name_zh":"Bin X-ray 二进制数据可视化分析工具","url":"https://github.com/russlank/BinXray","evidence_url":"https://github.com/russlank/BinXray/blob/1d965d0e8caa4787554c2b6211a9d0c915d715c7/README.md","description_en":"Bin X-ray visualizes byte patterns in unknown files and firmware blobs through a 256×256 byte-pair matrix and a 3D byte-trigram plot. A sliding window, ribbon overview, transition-offset search and hex view let analysts move from a pattern to its bytes in the file.","description_zh":"Bin X-ray 用 256×256 字节对矩阵和三维字节三元组图展示未知文件及固件数据中的模式。滑动窗口、总览带、字节对偏移搜索和十六进制视图可将可视化异常定位到具体字节。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"malware-deobfuscator","name":"Malware Deobfuscator","name_zh":"Malware Deobfuscator 恶意脚本去混淆工具","url":"https://github.com/X-Abhishek-X/malware-deobfuscator","evidence_url":"https://github.com/X-Abhishek-X/malware-deobfuscator/blob/f33320c31f07e252433d8eaf4937c43426ae1bd4/README.md","description_en":"Malware Deobfuscator analyzes obfuscated malware scripts and generates code, behavior and indicator reports. A deterministic pass extracts indicators with regexes and maps keyword signatures to MITRE ATT&CK; an OpenAI or Ollama model supplies deobfuscated code and execution-flow explanations. The CLI handles individual files or directories and can emit JSON.","description_zh":"Malware Deobfuscator 分析经过混淆的恶意脚本，输出代码、行为和指标报告。确定性流程用正则表达式提取 IOC、以关键词签名映射 MITRE ATT&CK；OpenAI 或 Ollama 模型补充去混淆代码与执行流程解释。命令行支持单文件和目录，并可输出 JSON。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"pic-disasm","name":"PIC microcontrollers disassembler","name_zh":"PIC microcontrollers disassembler PIC 单片机反汇编工具","url":"https://github.com/c-not-around/pic-disasm","evidence_url":"https://github.com/c-not-around/pic-disasm/blob/0b01587a82252dd3b51375ae8f3a036bd26147c2/README.md","description_en":"PIC microcontrollers disassembler converts Intel HEX dumps for MidRange and Enhanced MidRange PIC12/PIC16 devices into disassembly listings, HI-TECH PICC assembly files, or both. Processor descriptions and instruction definitions are supplied as JSON configuration files.","description_zh":"PIC microcontrollers disassembler 将 MidRange 和 Enhanced MidRange PIC12/PIC16 设备的 Intel HEX 转储转换为反汇编列表、HI-TECH PICC 汇编文件，或同时输出两者。处理器参数和指令定义存放在 JSON 配置文件中。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"flashkit","name":"flashkit","name_zh":"flashkit Flash 字节码分析工具包","url":"https://github.com/bitalizer/pyflashkit","evidence_url":"https://github.com/bitalizer/pyflashkit/blob/e50946b48d91d726aac2beec4e6252e3bd512f33/README.md","description_en":"flashkit is a Python toolkit for examining Adobe Flash SWF files and AVM2 bytecode. It parses and rebuilds SWF and ABC structures, disassembles instructions, constructs call and reference indexes, and decompiles classes or methods to ActionScript 3 through a control-flow pipeline.","description_zh":"flashkit 是分析 Adobe Flash SWF 与 AVM2 字节码的 Python 工具包，可解析及重建 SWF 和 ABC 结构、反汇编指令、建立调用与引用索引，并通过控制流分析将类或方法反编译为 ActionScript 3。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"petkit-local-case","name":"Petkit Local: reconstructing feeder cloud and fountain BLE controls","name_zh":"Petkit Local：重建喂食器云端接口与饮水机 BLE 控制","url":"https://github.com/Opcodeffm/petkit-local","evidence_url":"https://github.com/Opcodeffm/petkit-local/blob/235aaebad76586793b44921b712e5b58a91b8ef3/README.md","description_en":"Petkit Local replaces selected Petkit D4 feeder cloud exchanges with a local Home Assistant server and relays Eversweet Max 2 CTW3 fountain messages over BLE. The integration implements device registration, heartbeats, schedules, events and commands based on observed device communication.","description_zh":"Petkit Local 用本地 Home Assistant 服务响应 Petkit D4 喂食器的部分云端请求，并通过 BLE 中继 Eversweet Max 2 CTW3 饮水机消息。集成依据设备通信实现注册、心跳、计划、事件和控制命令。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"appthreat-wasm-tools","name":"AppThreat wasm-tools","name_zh":"AppThreat wasm-tools WebAssembly 解析与反汇编工具","url":"https://github.com/AppThreat/wasm-tools","evidence_url":"https://github.com/AppThreat/wasm-tools/blob/a90db706f9ac4f38aca8edd287d0e263beaa8104/README.md","description_en":"wasm-tools is a pure-Python parser and disassembler for WebAssembly core modules and Component Model binaries. It reports sections, decoded instructions, strings with memory provenance, imports, exports and static call graphs, then adds heuristic capability and risk findings in JSON.","description_zh":"wasm-tools 是纯 Python 编写的 WebAssembly 核心模块及 Component Model 二进制文件解析、反汇编工具。它输出段表、指令、带内存来源的字符串、导入导出项和静态调用图，并在 JSON 中加入启发式能力与风险判断。","kind":"tool","category":"webassembly","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"dos-mcp","name":"dos-mcp","name_zh":"dos-mcp DOS 程序分析 MCP 服务","url":"https://github.com/abedegno/dos-mcp","evidence_url":"https://github.com/abedegno/dos-mcp/blob/344add45ae3e961e2e9745c2c61d53b4fe295553/README.md","description_en":"dos-mcp connects AI agents to DOS programs running in js-dos for interactive reverse engineering. Its MCP tools send keyboard and mouse input, capture frames, exchange files with the guest and read or search emulated memory; the documentation shows a save-format comparison workflow using Ultima Underworld.","description_zh":"dos-mcp 将智能体连接到 js-dos 中运行的 DOS 程序，用于交互式逆向分析。MCP 工具可发送键鼠输入、抓取画面、交换客户机文件，并读取或搜索模拟内存；文档以 Ultima Underworld 展示存档格式对比流程。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary","game"],"verified_at":"2026-11-06"},{"id":"premium5-radio-emulator","name":"premium5","name_zh":"premium5 Volkswagen Premium 5 收音机固件仿真器","url":"https://github.com/mnaberez/premium5","evidence_url":"https://github.com/mnaberez/premium5/blob/f6713c5e4af2c07cf4936f1e0454c338b6c77fdf/README.md","description_en":"premium5 emulates the Volkswagen Premium 5 car radio at the register and signal level so its original firmware can run without patches. It models the NEC microcontroller, LCD controller, EEPROM and selected vehicle interfaces, with live disassembly, memory inspection and execution controls for firmware research.","description_zh":"premium5 在寄存器与信号层仿真 Volkswagen Premium 5 汽车收音机，使原版固件无需修改即可运行。它模拟 NEC 微控制器、LCD 控制器、EEPROM 及部分车载接口，并提供实时反汇编、内存检查和执行控制，供固件研究使用。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"ipi-stay-fly-driver-case","name":"IPI STAY FLY Driver: reconstructing mouse configuration over HID","name_zh":"IPI STAY FLY Driver：通过 HID 重建设备设置功能","url":"https://github.com/SpookyyQ/IPI-Stay-Fly-Driver","evidence_url":"https://github.com/SpookyyQ/IPI-Stay-Fly-Driver/blob/a302fc210e93ef8ff145cee915561b18342e4d7f/README.md","description_en":"IPI STAY FLY Driver reconstructs mouse configuration in a Windows app using reverse-engineered 16-byte HID frames. It exposes DPI, polling, button and sensor settings, documents a frame checksum, and includes a WebHID capture extension plus protocol notes for ATK FIERCE X.","description_zh":"IPI STAY FLY Driver 使用逆向得到的 16 字节 HID 报文，在 Windows 应用中重建鼠标配置功能。它提供 DPI、回报率、按键和传感器设置，记录报文校验和，并附有 WebHID 抓包扩展及 ATK FIERCE X 协议笔记。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"kaiju-re-framework","name":"Kaiju","name_zh":"Kaiju Rust 二进制分析框架","url":"https://github.com/nightwarelabz/kaiju","evidence_url":"https://github.com/nightwarelabz/kaiju/blob/86572f23fb852a1a5e816411f224b77b8ba262c0/docs/architecture.md","description_en":"Kaiju is a Rust reverse-engineering framework with a headless CLI for binary loading and analysis. Its current crates parse selected ELF, PE and Mach-O metadata, extract strings, decode a limited x86-64 instruction subset and inspect saved network evidence.","description_zh":"Kaiju 是带无界面命令行工具的 Rust 逆向框架。现有模块解析部分 ELF、PE、Mach-O 元数据，提取字符串，解码有限的 x86-64 指令集，并检查保存的网络证据。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"hxt9-x64dbg-mcp","name":"x64dbg MCP","name_zh":"x64dbg MCP 智能体调试接口","url":"https://github.com/HxT9/x64dbg_mcp","evidence_url":"https://github.com/HxT9/x64dbg_mcp/blob/6fc089130ef72028f5fee0250b3e855304ad2c2b/README.md","description_en":"x64dbg MCP gives agents debugger control over Windows binaries through a native x64dbg plugin and a C# stdio MCP server. The plugin serves local HTTP requests to x64dbg's bridge API, while MCP tools expose disassembly, memory and register access, modules, execution control, and breakpoints.","description_zh":"x64dbg MCP 通过原生 x64dbg 插件和 C# stdio MCP 服务器，让智能体分析 Windows 二进制程序。插件将本地 HTTP 请求转给 x64dbg bridge API；MCP 工具提供反汇编、内存与寄存器访问、模块查看、执行控制和断点操作。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-11-06"},{"id":"dreadcomp-case","name":"Metroid Dread: a hand decompilation in progress","name_zh":"Metroid Dread：进行中的手工反编译","url":"https://github.com/tsuyoi-w/DreadComp","evidence_url":"https://github.com/tsuyoi-w/DreadComp/blob/9e27711d32434bc5c479ba957b97ababc4b84857/README.md","description_en":"DreadComp is an in-progress hand decompilation of Metroid Dread that recreates game source code in C++. The repository includes initial source files, build tooling and symbol data; building requires assets and the version 2.1.0 executable from the user's own game copy.","description_zh":"DreadComp 正在以手工反编译方式重建《Metroid Dread》的 C++ 源代码。仓库已有初步源码、构建工具和符号数据；构建需要使用者自行提供游戏资产及 2.1.0 版可执行文件。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"soundcore-d3200-ble-case","name":"Soundcore D3200: reconstructing BLE recording transfer and decryption","name_zh":"Soundcore D3200：重建 BLE 录音传输与解密流程","url":"https://github.com/andrewseago/d3200-ble-note-downloader","evidence_url":"https://github.com/andrewseago/d3200-ble-note-downloader/blob/77356096b303bd8b68364ae21db2acd8194ac1ee/README.md","description_en":"A Soundcore D3200 investigation reconstructs the BLE exchange used to list and transfer encrypted recordings. Its Python client performs a P-256 ECDH handshake, derives session and file keys, decrypts AES-256-CTR Opus packets and writes an Ogg/Opus file.","description_zh":"该研究重建 Soundcore D3200 通过 BLE 列出和传输加密录音的消息流程。Python 客户端执行 P-256 ECDH 握手、派生会话与文件密钥、解密 AES-256-CTR Opus 数据包，并生成 Ogg/Opus 文件。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"k1-pro-opendeck-suite-case","name":"K1 Pro OpenDeck Suite: a Linux driver for the Stream Dock K1 Pro","name_zh":"K1 Pro OpenDeck Suite：Stream Dock K1 Pro 的 Linux 驱动","url":"https://github.com/leabergero/k1pro-opendeck-suite","evidence_url":"https://github.com/leabergero/k1pro-opendeck-suite/blob/d004b894efe29835207487851a28f03c5fa73cda/README.md","description_en":"K1 Pro OpenDeck Suite includes a Linux OpenDeck driver for the HOTSPOTEK/Mirabox Stream Dock K1 Pro based on its reverse-engineered USB/HID CRT protocol. The driver handles connection and keepalive messages, 64×64 JPEG key displays, RGB ring controls, and three knob inputs. Four accompanying plugins add generic OpenDeck functions.","description_zh":"K1 Pro OpenDeck Suite 包含适用于 Linux 的 HOTSPOTEK/Mirabox Stream Dock K1 Pro OpenDeck 驱动，依据逆向得到的 USB/HID CRT 协议实现。驱动处理连接与保活消息、按键屏幕的 64×64 JPEG 图像、RGB 灯环和三个旋钮输入；另附四个通用 OpenDeck 插件。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"open-picpak-case","name":"open-picpak: reconstructing the PicPak frame's BLE protocol and device behavior","name_zh":"open-picpak：重建 PicPak 相框的 BLE 协议与设备行为","url":"https://github.com/GottZ/open-PicPak","evidence_url":"https://github.com/GottZ/open-PicPak/blob/7b76daab2219b0a1c061fbe9fbf91747a8961954/documentation/ble-protocol.md","description_en":"open-picpak documents the PicPak 4.2-inch e-ink frame's stock firmware behavior, BLE GATT protocol, and image conversion pipeline. The author reports deriving byte-level findings from the stock ESP-IDF image and a device client, then using those findings in custom ESP-IDF firmware, host tools, and a self-hosted backend.","description_zh":"open-picpak 记录 PicPak 4.2 英寸电子墨水相框的原厂固件行为、BLE GATT 协议及图像转换流程。作者报告从原厂 ESP-IDF 镜像和设备客户端提取字节级信息，并据此开发自定义 ESP-IDF 固件、主机工具和自托管后端。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","protocol"],"verified_at":"2026-11-06"},{"id":"idotmatrix-ha-case","name":"iDotMatrix: Home Assistant control through a reconstructed BLE protocol","name_zh":"iDotMatrix：通过重建的 BLE 协议接入 Home Assistant","url":"https://github.com/dallanwagz/idotmatrix-ha","evidence_url":"https://github.com/dallanwagz/idotmatrix-ha/blob/e27d763dd06849ce7b7ccb54a4defc0a3fd5a295/README.md","description_en":"iDotMatrix Home Assistant integration controls the HXS-002 / NL-XSD-32 LED panel over a BLE protocol derived from analysis of the vendor Android app. Its vendored protocol module and hardware-capture tests support power, brightness, clock controls and chunked 32×32 image uploads with CRC32.","description_zh":"iDotMatrix Home Assistant 集成利用对厂商 Android 应用的分析所得 BLE 协议，控制 HXS-002 / NL-XSD-32 LED 面板。仓库中的协议模块和基于硬件抓包的测试覆盖电源、亮度、时钟控制，以及带 CRC32 的分块 32×32 图像上传。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"substack-api-reference","name":"Substack API Reference (Unofficial)","name_zh":"Substack API Reference（非官方）接口参考","url":"https://github.com/AnthonyDavidAdams/substack-api-reference","evidence_url":"https://github.com/AnthonyDavidAdams/substack-api-reference/blob/b9ebaf5cd58e527a3dba00689a2933e49a811310/README.md","description_en":"Substack API Reference documents the web app's undocumented JSON API using curl probes and captured browser requests. It records read and write endpoints, authentication and request bodies, and supplies an OpenAPI 3.1 specification with curl and TypeScript examples. The author reports 129 verified endpoints from 14 capture rounds.","description_zh":"Substack API Reference 通过 curl 探测和浏览器请求捕获，记录 Substack 网页应用未公开的 JSON API。资料涵盖读写端点、认证和请求体，并附 OpenAPI 3.1 规范、curl 与 TypeScript 示例。作者报告经过 14 轮采集，确认了 129 个端点。","kind":"documentation","category":"web-analysis","group":"learn","relationship":"learning","targets":["protocol","website"],"verified_at":"2026-11-06"},{"id":"zygisk-fridagadget","name":"Zygisk - Frida Gadget","name_zh":"Zygisk - Frida Gadget Android 应用插桩模块","url":"https://github.com/leolovenet/Zygisk-FridaGadget","evidence_url":"https://github.com/leolovenet/Zygisk-FridaGadget/blob/f685a901659452cecc4c281efc314422921fc127/README.md","description_en":"Zygisk - Frida Gadget loads Frida Gadget into selected Android app processes for runtime instrumentation. A configuration file selects packages, process names, ABIs, and profiles; deployment scripts place Gadget and its configuration in the app's native library directory before the Zygisk loader starts it.","description_zh":"Zygisk - Frida Gadget 将 Frida Gadget 加载到指定 Android 应用进程，供运行时插桩使用。配置文件指定包名、进程名、ABI 和配置档；部署脚本将 Gadget 及其配置放入应用原生库目录，再由 Zygisk 加载。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"web-crawler-reverse-agent","name":"web-crawler ReverseAgent","name_zh":"web-crawler ReverseAgent 网站 JavaScript 逆向智能体","url":"https://github.com/xiaomaozjj666/web-crawler","evidence_url":"https://github.com/xiaomaozjj666/web-crawler/blob/36dca34845702822a136a1ea60de7444aa687aee/README.md","description_en":"web-crawler includes ReverseAgent for investigating website JavaScript and request signing. It hooks fetch, XHR, cookies, crypto.subtle and webpack activity in a browser, captures traffic, separates webpack modules and uses an LLM to reimplement a discovered signature algorithm in Python.","description_zh":"web-crawler 内的 ReverseAgent 用于研究网站 JavaScript 和请求签名。它在浏览器中挂钩 fetch、XHR、cookie、crypto.subtle 和 webpack 活动，采集通信并拆分模块，再借助大语言模型用 Python 重实现签名算法。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-11-06"},{"id":"hyperscan-homebrew","name":"hyperscan-homebrew","name_zh":"hyperscan-homebrew Mattel HyperScan 硬件研究笔记","url":"https://github.com/vs-sr-dev/hyperscan-homebrew","evidence_url":"https://github.com/vs-sr-dev/hyperscan-homebrew/blob/54dd7aa7cb7078501b38ab55a440b8612195d36f/README.md","description_en":"hyperscan-homebrew documents Mattel HyperScan hardware behavior for homebrew and emulation work. Its notes cover SPG290 PPU registers, RFID reader signaling, controller I²C behavior, SPU audio and S+Core 7 compiler failures, drawing on MAME experiments and hardware captures where available.","description_zh":"hyperscan-homebrew 为 Mattel HyperScan 的自制程序与模拟工作记录硬件行为，涵盖 SPG290 PPU 寄存器、RFID 读卡器信号、手柄 I²C、SPU 音频及 S+Core 7 编译器故障。资料依据 MAME 实验，并在可行时与实机抓取结果对照。","kind":"documentation","category":"firmware","group":"learn","relationship":"learning","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"dell-controlvault2-fingerprint-linux-case","name":"Dell ControlVault 2 fingerprint on Linux: adapting a driver for BCM5880","name_zh":"Dell ControlVault 2 fingerprint on Linux：改造 BCM5880 驱动","url":"https://github.com/grosa787/dell-controlvault2-fingerprint-linux","evidence_url":"https://github.com/grosa787/dell-controlvault2-fingerprint-linux/blob/45609bee93a622bec27a3d062f0b42d2d63d45d3/PATCHES.md","description_en":"Dell ControlVault 2 fingerprint on Linux adapts a locally obtained Broadcom driver to the older BCM5880 fingerprint reader through five signature-matched byte patches. The accompanying investigation maps the device’s USB endpoints, command header and driver checks. The author reports working capture, while enrollment and matching remain unreliable or unconfirmed.","description_zh":"Dell ControlVault 2 fingerprint on Linux 通过五处字节特征补丁，使用户本地取得的 Broadcom 驱动识别较旧的 BCM5880 指纹设备。研究记录了设备的 USB 端点、命令头及驱动检查逻辑。作者报告指纹采集可用，但录入与比对仍不稳定或尚未确认。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","protocol"],"verified_at":"2026-11-06"},{"id":"epson-l3110-driver-case","name":"epson-l3110-driver: investigating the printer's USB and ESC/P-R exchanges","name_zh":"epson-l3110-driver：分析 Epson L3110 的 USB 与 ESC/P-R 通信","url":"https://github.com/mikel-btw/epson-l3110-driver","evidence_url":"https://github.com/mikel-btw/epson-l3110-driver/blob/e0fbf772b698bf010e3fe39bc1eb19034f0dee06/docs/protocol-notes.md","description_en":"epson-l3110-driver investigates the Epson L3110's USB printing exchanges while developing a Linux driver in C. Its notes use captured print-job traffic to identify the IEEE 1284 device ID, EJL session setup and ESC/P-R command framing. USB communication is still in progress, and the driver cannot yet print pages.","description_zh":"epson-l3110-driver 在开发 C 语言 Linux 驱动的同时研究 Epson L3110 的 USB 打印通信。协议笔记根据打印作业抓包记录 IEEE 1284 设备 ID、EJL 会话建立及 ESC/P-R 命令格式。USB 通信功能仍在开发，驱动尚不能打印页面。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"ms5-wifi-microscope-case","name":"MS5 WiFi Microscope: reconstructing the camera's UDP video protocol","name_zh":"MS5 WiFi Microscope：复原显微镜的 UDP 视频协议","url":"https://github.com/Fyfar/ms5-wifi-microscope","evidence_url":"https://github.com/Fyfar/ms5-wifi-microscope/blob/16cf577bca5cb3da72dd4b7a8240d6e9f9d209f2/README.md","description_en":"MS5 WiFi Microscope reconstructs the MS5 camera's UDP command and video protocol and supplies a Python client that serves its reassembled JPEG stream as MJPEG. The documentation specifies command headers, the OpenVideo port handshake, chunk layout and resolution queries; the author reports 1280×720 streaming at roughly 25–30 fps on MS5 hardware.","description_zh":"MS5 WiFi Microscope 复原 MS5 相机的 UDP 控制与视频协议，并用 Python 客户端将重组后的 JPEG 帧以 MJPEG 提供给浏览器或播放器。文档列出命令头、OpenVideo 端口握手、分片布局和分辨率查询；作者报告在 MS5 实机上获得约 25–30 fps 的 1280×720 画面。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"lux-lat-long-log-case","name":"lux-lat-long-log: reconstructing LUMIX S5 BLE GPS communication","name_zh":"lux-lat-long-log：重建 LUMIX S5 蓝牙定位通信","url":"https://github.com/tobiasbrummer/lux-lat-long-log","evidence_url":"https://github.com/tobiasbrummer/lux-lat-long-log/blob/87e51686c8496ca20fa8b14433ba548383f8da5b/README.md","description_en":"lux-lat-long-log reconstructs the Panasonic LUMIX S5 Bluetooth LE GPS exchange in an ESP32 camera client. The project documents GATT identifiers, session ordering and GPS/time packets from Android HCI captures, then uses a GNSS module to send positions without the phone app.","description_zh":"lux-lat-long-log 利用 ESP32 固件重建 Panasonic LUMIX S5 的 BLE 定位通信，无需厂商手机应用即可向相机发送位置。项目根据 Android HCI 抓包记录 GATT 标识、会话顺序及 GPS 和时间数据包，并使用 GNSS 模块提供位置数据。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"mtg-arena-collection-export-case","name":"MTG Arena Collection Export: reconstructing the Frontdoor collection request","name_zh":"MTG Arena Collection Export：重建 Frontdoor 卡牌收藏请求","url":"https://github.com/Ikreb1/mtg-arena-collection-export","evidence_url":"https://github.com/Ikreb1/mtg-arena-collection-export/blob/a63edadee8160b18ac7c8d6387cab7ec53ccd294/docs/PROTOCOL.md","description_en":"MTG Arena Collection Export reconstructs the Frontdoor request needed to export owned cards from Magic: The Gathering Arena. The Python client uses an account refresh token, opens a TLS Frontdoor socket, authenticates with the 2026 version 4 frame and protobuf command envelope, and requests Card_GetAllCards. A separate protocol document records the recovered wire format.","description_zh":"MTG Arena Collection Export 重建 Magic: The Gathering Arena 的 Frontdoor 卡牌收藏请求。Python 客户端使用账户刷新令牌连接 TLS 套接字，以 2026 年的第 4 版帧和 protobuf 命令封套认证，再调用 Card_GetAllCards；独立文档记录了还原出的线协议。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game","protocol"],"verified_at":"2026-11-06"},{"id":"magene-l308-taillight-case","name":"Magene L308: reconstructing a smart taillight's BLE control protocol","name_zh":"Magene L308：重建智能尾灯的 BLE 控制协议","url":"https://github.com/mchardysam/magene-l308-taillight","evidence_url":"https://github.com/mchardysam/magene-l308-taillight/blob/346da4577e6980b48b50f7f02e387280c165a812/spec/L308-ble-protocol.md","description_en":"Magene L308 interop tools reconstruct the smart taillight's BLE control protocol and light_mode.bin pattern format. A protocol specification records GATT characteristics, command frames and upload sequences; browser, Python and Garmin clients use those findings to control settings and patterns directly.","description_zh":"Magene L308 互操作工具重建了这款智能尾灯的 BLE 控制协议和 light_mode.bin 图案文件格式。协议文档记录 GATT 特征、命令帧和上传流程；浏览器、Python 和 Garmin 客户端利用这些研究结果直接控制尾灯的设置与图案。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"void-client-case","name":"Void Client: rebuilding the Starblast.io client","name_zh":"Void Client：重建 Starblast.io 游戏客户端","url":"https://github.com/Senko74/Void-Client","evidence_url":"https://github.com/Senko74/Void-Client/blob/005183d271b907e0466228b185daace893f95e4c/README.md","description_en":"Void Client is an unfinished JavaScript rewrite of the Starblast.io browser game client based on study of its network protocol. Its current Node.js and browser components provide game-mode selection, server discovery, local WebSocket communication, and parsing and JSON export of some received packets.","description_zh":"Void Client 是一个尚未完成的 Starblast.io 浏览器游戏客户端 JavaScript 重建项目，基于对其网络协议的研究。现有 Node.js 服务端和浏览器组件提供游戏模式选择、服务器发现、本地 WebSocket 通信，并解析部分收到的数据包，将其导出为 JSON。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game","protocol"],"verified_at":"2026-11-06"},{"id":"xbloom-ble-case","name":"xbloom-ble: a client for the xBloom Studio BLE protocol","name_zh":"xbloom-ble：xBloom Studio 蓝牙协议客户端","url":"https://github.com/Janczykkkko/xbloom-ble","evidence_url":"https://github.com/Janczykkkko/xbloom-ble/blob/cfa29daa771fdd147de78c1844d2251ca81ea583/docs/REVERSE-ENGINEERING.md","description_en":"xbloom-ble implements a Python client for the xBloom Studio coffee machine's recovered Bluetooth LE protocol. The author documents capturing app traffic and comparing GATT command frames; the CLI and terminal UI load recipes, program dial presets, optionally start brewing and display live scale telemetry.","description_zh":"xbloom-ble 是针对 xBloom Studio 咖啡机已解析 Bluetooth LE 协议的 Python 客户端。作者记录了采集手机应用流量、比较 GATT 命令帧的过程；命令行与终端界面可加载配方、设置旋钮预设、按明确指令启动冲煮，并显示实时称重数据。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"ajazz-ak820-pro-mac-case","name":"ak820: reconstructing AJAZZ AK820 Pro HID control on macOS","name_zh":"ak820：在 macOS 上重建 AJAZZ AK820 Pro 的 HID 控制协议","url":"https://github.com/gusleig/ajazz-ak820-pro-mac","evidence_url":"https://github.com/gusleig/ajazz-ak820-pro-mac/blob/2ad5c553140b50b62e1b93096dc089086976351e/README.md","description_en":"ak820 implements macOS control of the AJAZZ AK820 Pro keyboard through its vendor HID feature-report protocol. The Python CLI sets the clock, RGB lighting, and sleep timer over USB; accompanying notes describe Windows-driver analysis, packet framing, transaction handshakes, and the unresolved key-remapping commands.","description_zh":"ak820 通过 AJAZZ AK820 Pro 的厂商 HID feature report 协议在 macOS 上控制键盘。Python 命令行工具经 USB 设置时钟、RGB 灯光和休眠时间；附带文档记录 Windows 驱动分析、数据包封装、事务握手及尚未解决的按键重映射命令。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"grb-modding-knowledgebase","name":"GRB Modding Knowledgebase","name_zh":"GRB Modding Knowledgebase《Ghost Recon: Breakpoint》格式研究与工具","url":"https://github.com/dataterminals/grb-modding-knowledgebase","evidence_url":"https://github.com/dataterminals/grb-modding-knowledgebase/blob/4641d9b938ea81a3267873716f268c1c17883433/README.md","description_en":"GRB Modding Knowledgebase documents Ghost Recon: Breakpoint’s Anvil .forge archives, nested .data resources and asset replacement workflow. Its Python inspectors examine MotionCloth files, list resource types, compare forge indexes and diff gameplay database records to explore field layouts.","description_zh":"GRB Modding Knowledgebase 记录《Ghost Recon: Breakpoint》的 Anvil .forge 归档、嵌套的 .data 资源及资产替换流程。其 Python 工具检查 MotionCloth 文件、列出资源类型、比较 forge 索引，并通过比较游戏数据库记录探索字段布局。","kind":"project","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"wechat-4-1-10-macos-key-case","name":"WeChat: recovering SQLCipher keys through CommonCrypto hooks","name_zh":"WeChat：通过 CommonCrypto 钩子提取 SQLCipher 密钥","url":"https://github.com/Evanyuan-builder/wechat-4.1.10-macos-key","evidence_url":"https://github.com/Evanyuan-builder/wechat-4.1.10-macos-key/blob/14acb2ea420197e493c579914fe138960246310a/README.md","description_en":"An investigation of WeChat 4.1.10 for macOS reports recovering per-database SQLCipher keys by breaking on CommonCrypto encryption calls in LLDB. It compares that approach with memory scanning and sqlite3_key breakpoints, and describes an offline check against a decrypted SQLite page.","description_zh":"这项研究针对 macOS 版 WeChat 4.1.10，作者报告通过 LLDB 在 CommonCrypto 加密调用处设置断点，提取各数据库的 SQLCipher 密钥。文档比较内存扫描与 sqlite3_key 断点，并说明如何用 SQLite 页面离线核对密钥。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","binary"],"verified_at":"2026-11-06"},{"id":"gametrak-liberation-case","name":"GameTrak Liberation: a client for the controller's HID protocol","name_zh":"GameTrak Liberation：基于控制器 HID 协议的客户端","url":"https://github.com/CreativeInquiry/GameTrak-Liberation","evidence_url":"https://github.com/CreativeInquiry/GameTrak-Liberation/blob/bc8c2f96c86c15f016939777e9694f1366cb2836/README.md","description_en":"GameTrak Liberation implements a client for the GameTrak controller's reverse-engineered USB HID behavior. It sends the initialization and rolling-key keepalive messages needed for sustained reports, then exposes six-axis data through stdout, OSC, MIDI or WebSockets. Protocol notes, report captures and Processing and p5.js examples accompany the Python tools.","description_zh":"GameTrak Liberation 根据逆向得到的 USB HID 行为实现控制器客户端。它发送初始化消息和滚动密钥保活包，以持续接收六轴数据，并通过 stdout、OSC、MIDI 或 WebSockets 输出。仓库还提供协议笔记、报告采样及 Processing 和 p5.js 示例。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"cooper-hunter-ac-protocol-case","name":"Cooper Hunter AC: UART and infrared protocol investigation","name_zh":"Cooper Hunter AC：UART 与红外协议调查","url":"https://github.com/kronhait/cooper-hunter-ac-esphome","evidence_url":"https://github.com/kronhait/cooper-hunter-ac-esphome/blob/aceab67f8621e5e17c52ffbbb9a7964524b79783/README.md","description_en":"Cooper Hunter AC documents the COM1 UART and infrared control messages of CH-IF140RK and CH-IF140RK2 units with a Gree GRZQ3-R V1 board. The author inferred UART status fields by comparing packets while operating the infrared remote. The resulting ESPHome design receives UART status and sends control through an infrared signal path.","description_zh":"Cooper Hunter AC 记录了使用 Gree GRZQ3-R V1 板卡的 CH-IF140RK 与 CH-IF140RK2 空调的 COM1 UART 和红外控制消息。作者对比红外遥控操作前后的数据包，推断 UART 状态字段；最终 ESPHome 方案通过 UART 接收状态，经红外信号路径发送控制。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"yandex-station-local-streaming","name":"Локальный аудиостриминг на Яндекс.Станцию","name_zh":"Локальный аудиостриминг на Яндекс.Станцию：Yandex Station 本地音频协议指南","url":"https://github.com/volodarskij/yandex-station-local-streaming","evidence_url":"https://github.com/volodarskij/yandex-station-local-streaming/blob/085c0a42458620cc7288726e48e5726caae2f0d6/README.md","description_en":"Local audio streaming on Yandex Station is a technical guide to the device’s Glagol WebSocket control channel and its HTTP audio-stream behavior. It documents radio_play, token acquisition, message formats and MP3 CBR stream requirements, including an exact Content-Length.","description_zh":"这份 Yandex Station 本地音频指南记录了设备的 Glagol WebSocket 控制通道及 HTTP 音频流行为，涵盖 radio_play、令牌获取、消息格式，以及 MP3 CBR 和准确 Content-Length 等播放条件。","kind":"documentation","category":"protocol-analysis","group":"learn","relationship":"learning","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"psp-media-slopkit","name":"psp-media-slopkit","name_zh":"psp-media-slopkit PSP XMB 媒体格式工具包","url":"https://github.com/TotalKommando/psp-media-toolkit","evidence_url":"https://github.com/TotalKommando/psp-media-toolkit/blob/3e4825e60823fb9364284030e8baffea542ea546/README.md","description_en":"psp-media-slopkit analyses PSP XMB ICON1.PMF and SND0.AT3 files using format findings derived from retail game samples. Its Python CLI checks media against documented XMB limits, converts video and audio into icon media, and inserts the results into a homebrew EBOOT.PBP. FINDINGS.md records PSMF container fields, H.264 constraints and AT3 playback behaviour.","description_zh":"psp-media-slopkit 根据零售游戏样本的格式分析，检查 PSP XMB 使用的 ICON1.PMF 和 SND0.AT3 文件。Python 命令行工具可按文档中的 XMB 限制验证媒体、转换视频和音频，并写入自制软件的 EBOOT.PBP；FINDINGS.md 记录了 PSMF 容器字段、H.264 约束和 AT3 播放行为。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"siriously-writing-tools-case","name":"Siriously: recovering macOS Writing Tools entry points","name_zh":"Siriously：恢复 macOS Writing Tools 的调用入口","url":"https://github.com/bo2themax/Siriously","evidence_url":"https://github.com/bo2themax/Siriously/blob/01c29a7e7e8d96a9aaf0d89b3919cd1c8b794c77/FINDINGS.md","description_en":"Siriously investigates how macOS 27 changed access to Writing Tools and restores its popover through a Services client. The author used Objective-C runtime introspection and behavioral tracing to identify private WritingToolsUI classes, then passes selected text to the popover and writes accepted results back through Accessibility APIs. The findings concern one macOS build.","description_zh":"Siriously 研究 macOS 27 中 Writing Tools 调用入口的变化，并通过 Services 客户端恢复弹窗。作者用 Objective-C 运行时探查与行为跟踪定位 WritingToolsUI 私有类，将所选文本送入弹窗，再通过辅助功能 API 回写结果。分析针对一个系统构建版本。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","binary"],"verified_at":"2026-11-06"},{"id":"sqlce","name":"sqlce","name_zh":"sqlce SQL Server Compact SDF 文件解析库","url":"https://github.com/boykopovar/sqlce","evidence_url":"https://github.com/boykopovar/sqlce/blob/78a3888b028952e0157bde1d1fd0a7b30edc4747/README.md","description_en":"sqlce reads SQL Server Compact .sdf database files using a cross-platform C++ parser informed by analysis of decompiled SQL CE components. Python and WebAssembly bindings expose table names, schemas and rows, including files encrypted with a supplied password.","description_zh":"sqlce 根据对反编译 SQL CE 组件的分析，以跨平台 C++ 解析器读取 SQL Server Compact .sdf 数据库文件。Python 与 WebAssembly 绑定可读取表名、结构和记录，也支持使用提供的密码读取加密文件。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"dualrip","name":"DualRip","name_zh":"DualRip Nintendo DS 与 3DS 音频提取工具","url":"https://github.com/TetraSsky/DualRip","evidence_url":"https://github.com/TetraSsky/DualRip/blob/f69e23c63a7d0985a474d0cbaeb2b364174748ac/README.md","description_en":"DualRip extracts Nintendo DS sound effects and music from SDAT archives and Nintendo 3DS audio from CSAR archives, including ROM inputs. It parses sequence, wave and stream formats, emulates the consoles' sound drivers for rendering and exports WAV files with loop points through CLI and GUI frontends.","description_zh":"DualRip 从 Nintendo DS 的 SDAT 和 Nintendo 3DS 的 CSAR 档案提取音效与音乐，也支持游戏 ROM 输入。它解析序列、波形和流格式，模拟主机音频驱动进行渲染，并通过命令行或图形界面导出含循环点的 WAV 文件。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"aw5d-linux-case","name":"aw5d-linux: driving an iBUYPOWER cooler LCD from USB-HID research","name_zh":"aw5d-linux：依据 USB-HID 协议研究驱动 iBUYPOWER 散热器屏幕","url":"https://github.com/claygorman/aw5d-linux","evidence_url":"https://github.com/claygorman/aw5d-linux/blob/e70d481429b9bf1470bd21a9b33ebfd9e5db491c/RESEARCH.md","description_en":"aw5d-linux drives the round LCD on an iBUYPOWER AW5/AW5D cooler from Linux using a 64-byte USB-HID output report. Its research notes document report ID 0x10 and byte positions for CPU usage, clock, temperature and gauge styling. The author reports a working display on one 3402:0407 unit; other device variants remain unconfirmed.","description_zh":"aw5d-linux 在 Linux 上通过 64 字节 USB-HID 输出报告驱动 iBUYPOWER AW5/AW5D 散热器的圆形屏幕。研究笔记记录报告 ID 0x10，以及 CPU 使用率、频率、温度和仪表样式对应的字节位置。作者报告已在一台 3402:0407 设备上运行，其他变体尚未确认。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"mirrorframe","name":"Mirrorframe","name_zh":"Mirrorframe 网页采集与 React 重建工具","url":"https://github.com/byte271/mirrorframe","evidence_url":"https://github.com/byte271/mirrorframe/blob/16ffce02957bbc7f28f5ea1b38e40bea3ff4fd37/README.md","description_en":"Mirrorframe captures webpages with Playwright and reconstructs their observed layout and behavior as a self-contained React app. It records computed styles, assets, motion and selected interaction states, then compares rendered nodes and replayed states against the original with image diffs.","description_zh":"Mirrorframe 使用 Playwright 采集网页，并将观察到的布局和行为重建为独立的 React 应用。它记录计算样式、资源、动效和部分交互状态，再通过图像差异，将重建后的节点和重放状态与原网页比对。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-11-06"},{"id":"adb-mcp","name":"adb-mcp","name_zh":"adb-mcp Android 调试桥智能体接口","url":"https://github.com/FlashZ/adb-mcp","evidence_url":"https://github.com/FlashZ/adb-mcp/blob/84533098932fb0a7c866e3f3b30a6da8d9311f90/README.md","description_en":"adb-mcp gives agents structured Android Debug Bridge tools for investigating app behavior on a device. It can launch packages, inspect the UI hierarchy, capture logcat records and screenshots, retrieve files, and set up port forwarding. Its documentation shows a command sequence for investigating an in-app action through UI interaction and logs.","description_zh":"adb-mcp 将 Android Debug Bridge 操作封装为供智能体使用的结构化工具，用于调查设备上的应用行为。它可启动应用、检查界面层级、采集 logcat 日志与截图、提取文件并配置端口转发。文档给出了通过界面操作和日志调查应用内动作的命令示例。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app"],"verified_at":"2026-11-06"},{"id":"hacking-the-xbox-ja","name":"Hacking the Xbox — 日本語訳","name_zh":"Hacking the Xbox：日文译本","url":"https://github.com/Nico-Tech-Shenzhen/hacking-the-xbox-ja","evidence_url":"https://github.com/Nico-Tech-Shenzhen/hacking-the-xbox-ja/blob/45dfd86050af4afae590dd6ac5247b8bd610e010/README.md","description_en":"Hacking the Xbox — 日本語訳 publishes a Japanese translation of a book on Xbox reverse engineering. The repository includes translated introductory material and chapters 1–6 with figures; later chapters and appendices remain pending.","description_zh":"Hacking the Xbox — 日本語訳提供 Xbox 逆向工程著作的日文译文。仓库已有导读及第 1 至第 6 章的译文和配图，后续章节与附录尚待翻译。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"inkterop","name":"inkterop","name_zh":"inkterop 手写笔记格式转换与分析工具","url":"https://github.com/cable729/inkterop","evidence_url":"https://github.com/cable729/inkterop/blob/f16eb8d2a425637aab629e6cc90c00a18f17009f/README.md","description_en":"inkterop converts native handwriting files from note apps and e-ink devices through a documented intermediate representation. It reads stroke data including pressure and tilt where present, implements readers for formats such as GoodNotes and Notability, and publishes format investigation notes and conversion fidelity modes.","description_zh":"inkterop 通过有文档说明的中间表示转换笔记应用和电子墨水设备的原生手写文件。它读取笔画及文件中保存的压力、倾斜数据，实现 GoodNotes、Notability 等格式的读取器，并发布格式调查记录和转换保真模式。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"myjbxheadsetcontrol-case","name":"MyJBxHeadsetControl: JBL Quantum 950 controls over USB HID","name_zh":"MyJBxHeadsetControl：通过 USB HID 控制 JBL Quantum 950","url":"https://github.com/666mille/MyJBxHeadsetControl","evidence_url":"https://github.com/666mille/MyJBxHeadsetControl/blob/0c839ef79445763d96a365daf9dd98a07db2064b/README.md","description_en":"MyJBxHeadsetControl provides Stream Deck controls for the JBL Quantum 950 Wireless headset through its USB dongle's reverse-engineered HID exchange. It receives status packets for battery and sound modes, sends feature reports for settings, and uses the user's QuantumENGINE DLL to calculate EQ coefficients.","description_zh":"MyJBxHeadsetControl 通过已研究的 USB HID 数据交换，让 Stream Deck 控制 JBL Quantum 950 Wireless 耳机。插件读取电量和音效模式状态包，发送设置命令，并调用用户本机的 QuantumENGINE DLL 计算均衡器系数。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"sprdflash-rs","name":"SPRD Flash Tool","name_zh":"SPRD Flash Tool SPRD/UNISOC 固件读取与分区分析工具","url":"https://github.com/ajsb85/sprdflash-rs","evidence_url":"https://github.com/ajsb85/sprdflash-rs/blob/451c61ee63420c8aa4ee504e4b70fd8e6f0a8521/README.md","description_en":"SPRD Flash Tool implements the SPRD/UNISOC PAC download protocol in Rust for RDA8910 and UIS8910 devices. Its analysis functions read partitions or whole flash through READ_FLASH and infer a proposed BMAConfig layout from U-Boot, LuatOS and filesystem regions; the author reports byte comparisons on an Air724UG.","description_zh":"SPRD Flash Tool 用 Rust 实现面向 RDA8910 和 UIS8910 设备的 SPRD/UNISOC PAC 下载协议。分析功能通过 READ_FLASH 读取分区或整片闪存，并依据 U-Boot、LuatOS 及文件系统区域推测 BMAConfig 分区布局；作者报告在 Air724UG 上进行了字节比对。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware","protocol"],"verified_at":"2026-11-06"},{"id":"openpigeon-case","name":"OpenPigeon: reconstructing GamePigeon iMessage game messages","name_zh":"OpenPigeon：重建 GamePigeon iMessage 游戏消息","url":"https://github.com/time-attack/OpenPigeon","evidence_url":"https://github.com/time-attack/OpenPigeon/blob/86c649174f3521d79a7c7eda58725c99286804b7/docs/PROTOCOL.md","description_en":"OpenPigeon is a TypeScript codec for reading GamePigeon iMessage game state and encoding caller-supplied moves for eleven turn-based games. Its protocol documentation describes balloon identity, encrypted move URLs, the length-seeded cipher and the state envelope; captured-message vectors support codec tests.","description_zh":"OpenPigeon 是 TypeScript 编解码器，可读取十一款 GamePigeon 回合制 iMessage 游戏的状态，并将调用方提供的操作编码为消息。协议文档说明消息气泡标识、加密操作 URL、以长度为种子的置换密码和状态封装；仓库还提供用于编解码测试的消息采样。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game","protocol"],"verified_at":"2026-11-06"},{"id":"zltrouter-case","name":"zlt: MTN ZLT T10D MAX router API reconstruction","name_zh":"zlt：MTN ZLT T10D MAX 路由器 API 还原","url":"https://github.com/exbyte-dev/zltrouter","evidence_url":"https://github.com/exbyte-dev/zltrouter/blob/60a47a6dfbd435a52da428c575b373e431e3f330/docs/protocol.md","description_en":"zlt reconstructs the LAN JSON API of the MTN ZLT T10D MAX router from its served JavaScript and observed responses. Its Python client handles reqproc requests, login and CSRF behavior, while a CLI and local dashboard expose signal, network mode, SMS and USSD operations. The protocol document identifies firmware-specific fields and porting limits.","description_zh":"zlt 根据 MTN ZLT T10D MAX 路由器提供的 JavaScript 和实机响应还原其局域网 JSON API。Python 客户端处理 reqproc 请求、登录与 CSRF 机制；命令行和本地面板提供信号、网络模式、短信及 USSD 操作。协议文档指出了固件特定字段与移植限制。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"claude-rc-api-case","name":"claude-rc-api: reconstructing Claude Code Remote Control endpoints","name_zh":"claude-rc-api：还原 Claude Code Remote Control 接口","url":"https://github.com/ThatCrispyToast/claude-rc-api","evidence_url":"https://github.com/ThatCrispyToast/claude-rc-api/blob/fac6d28eb1cf797f95abe22ee95b7f23fb246e4d/API_REFERENCE.md","description_en":"claude-rc-api reconstructs the private HTTP interface used to control local Claude Code sessions from claude.ai/code. Its reference derives session endpoints, OAuth authentication, event envelopes, and streaming behavior from the CLI binary; a Python library and CLI use that interface to observe and steer sessions.","description_zh":"claude-rc-api 还原 claude.ai/code 控制本地 Claude Code 会话所用的私有 HTTP 接口。参考文档依据 CLI 可执行文件整理会话端点、OAuth 认证、事件封装和流式响应；Python 库与命令行工具据此查看及控制会话。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"spelunking","name":"Spelunking","name_zh":"Spelunking Apple 框架与服务研究","url":"https://github.com/gaelic-ghost/spelunking","evidence_url":"https://github.com/gaelic-ghost/spelunking/blob/8badd03b92b7059f69b625be29860ee8a4b5d8aa/README.md","description_en":"Spelunking studies Apple apps, private frameworks and system services with Swift and Objective-C probes. It inventories runtime classes, symbols, notifications and MediaRemote state, while publishing target-specific writeups and raw captures for Messages, Phone, MediaRemote and UserNotifications.","description_zh":"Spelunking 使用 Swift 和 Objective-C 探针研究 Apple 应用、私有框架及系统服务。项目盘点运行时类、符号、通知和 MediaRemote 状态，并为 Messages、Phone、MediaRemote 与 UserNotifications 保存分目标说明及原始采集记录。","kind":"research","category":"native-analysis","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-11-06"},{"id":"hisense-aeh-w41h1-local-control-case","name":"Hisense AEH-W41H1: local A/C control over a reconstructed RS-485 bus","name_zh":"Hisense AEH-W41H1：基于还原的 RS-485 总线实现空调本地控制","url":"https://github.com/AndrewDemsDS/hisense-w41h1","evidence_url":"https://github.com/AndrewDemsDS/hisense-w41h1/blob/678cc64dc28aa19e365be354a38917cf5506f9e6/README.md","description_en":"Hisense AEH-W41H1 local control replaces the air conditioner's cloud-connected Wi-Fi module with ESPHome firmware for an ESP32 board or the stock RTL8710C module. The implementation speaks the A/C's RS-485 bus and exposes climate controls and diagnostics to Home Assistant. Protocol notes describe the frame envelope, checksum, bus roles, and command/status behavior derived from device observation.","description_zh":"Hisense AEH-W41H1 本地控制项目通过 ESP32 板替换空调原有的 Wi-Fi 模块，或在原装 RTL8710C 模块上刷入 ESPHome 固件。固件通过空调的 RS-485 总线通信，并向 Home Assistant 提供温控和诊断信息。协议文档记录了通过设备观察确定的帧结构、校验和、总线角色及命令与状态的交互行为。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","protocol"],"verified_at":"2026-11-06"},{"id":"whatsapp-docs","name":"whatsapp-docs","name_zh":"whatsapp-docs WhatsApp Android 逆向文档","url":"https://github.com/7ucg/whatsapp-docs","evidence_url":"https://github.com/7ucg/whatsapp-docs/blob/72e741c2a4e6b8f92819d441a7e2148a8fcf2926/README.md","description_en":"whatsapp-docs records findings from static decompilation of the WhatsApp Android APK, covering app internals and communication formats. Its reports describe linked-device pairing, Noise transport, reporting stanzas, media upload and other client flows, with findings distinguished from inferences.","description_zh":"whatsapp-docs 汇集对 WhatsApp Android APK 进行静态反编译所得的应用内部机制和通信格式研究，涵盖多设备配对、Noise 传输、举报 stanza、媒体上传及其他客户端流程，并区分代码发现与推断。","kind":"documentation","category":"android","group":"learn","relationship":"learning","targets":["app","protocol"],"verified_at":"2026-11-06"},{"id":"hermes-flipperzero","name":"Hermes","name_zh":"Hermes Flipper Zero UART 波特率检测与控制台工具","url":"https://github.com/at0m-b0mb/Hermes-FlipperZero","evidence_url":"https://github.com/at0m-b0mb/Hermes-FlipperZero/blob/9c463e3ace408f69939495b2bd1e9f9b86b195c2/README.md","description_en":"Hermes is a Flipper Zero app for identifying unknown UART settings and inspecting a device's serial console. It timestamps line edges to estimate bit time, checks candidate rates and parity against received UART bytes, then offers a terminal with text, hex and capture features. The source states that detection leaves the transmit pin undriven until the user sends data.","description_zh":"Hermes 是一款 Flipper Zero 应用，用于识别未知 UART 设置并查看设备串口控制台。它通过边沿时间估算位时长，再用硬件 UART 收到的字节核对候选波特率与校验位，随后提供文本、十六进制和记录功能；项目说明检测阶段不会驱动发送引脚。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"wmatcher","name":"wMatcher","name_zh":"wMatcher JAR 版本类匹配工具","url":"https://github.com/earthsworth/wMatcher","evidence_url":"https://github.com/earthsworth/wMatcher/blob/225940a4df4e05742fff722019fe81fc4a023db8/README.md","description_en":"wMatcher compares two Java archives to match classes renamed or obfuscated between releases. Its desktop workflow loads old and new JARs, accepts dependency JARs, lets the analyst correct uncertain matches and saves the comparison as a .wmatch project.","description_zh":"wMatcher 比较两个版本的 Java 归档文件，匹配版本间重命名或混淆的类。桌面界面可加载新旧 JAR 和所需依赖，供分析者修正不确定的匹配，并将结果保存为 .wmatch 工程。","kind":"tool","category":"binary-diffing","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"ygo-poc-toolset","name":"YGO-PoC Toolset","name_zh":"YGO-PoC Toolset 游戏资源与存档工具集","url":"https://github.com/bitemydusto/YGO-PoC-Toolset","evidence_url":"https://github.com/bitemydusto/YGO-PoC-Toolset/blob/76a9eab2dcfa3f215af9b52a162ae576961304ba/README.md","description_en":"YGO-PoC Toolset handles resource and save formats from Yu-Gi-Oh! Power of Chaos – Joey the Passion. Its unpacker extracts compressed game resource files such as data.dat, while PoCTools decrypts, edits and re-encrypts system.dat saves; the repository also includes a card editor and DLL mod loader.","description_zh":"YGO-PoC Toolset 处理《Yu-Gi-Oh! Power of Chaos – Joey the Passion》的资源与存档格式。解包器提取 data.dat 等压缩资源文件，PoCTools 可解密、编辑并重新加密 system.dat 存档；仓库还包含卡牌编辑器和 DLL 模组加载器。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"website-to-cli","name":"website-to-cli","name_zh":"website-to-cli 网站流量转命令行客户端","url":"https://github.com/dennisonbertram/website-to-cli","evidence_url":"https://github.com/dennisonbertram/website-to-cli/blob/e24d11f878a03dcaee9479a1fb165d20ce2da5a0/README.md","description_en":"website-to-cli is an agent skill for deriving terminal clients from captured website traffic. Its scripts record a HAR and filter requests to identify endpoint methods, paths, parameters, payload shapes and authentication headers. The skill then uses a Bun CLI template to build a client. The repository includes clients for crates.io and Hacker News search.","description_zh":"website-to-cli 是根据网站流量构建命令行客户端的智能体技能。其脚本录制 HAR、过滤请求，并整理端点的方法、路径、参数、请求与响应结构及鉴权头。技能随后使用 Bun CLI 模板构建客户端。仓库提供 crates.io 和 Hacker News 搜索的客户端示例。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["website"],"verified_at":"2026-11-06"},{"id":"fh6-model-tools","name":"FH6 Model Tools","name_zh":"FH6 Model Tools 游戏资源格式解析工具","url":"https://github.com/noidex0/fh6-model-tools","evidence_url":"https://github.com/noidex0/fh6-model-tools/blob/db9a203726107a7debed516b99d2f8dbaa713991/README.md","description_en":"FH6 Model Tools parses reverse-engineered Forza Horizon 6 asset formats, including burG model and texture containers. Python converters export car meshes to GLB or OBJ, textures to DDS, and selected material, palette, lighting, and ambient-occlusion data to readable outputs.","description_zh":"FH6 Model Tools 解析《极限竞速：地平线 6》的逆向资源格式，包括 burG 模型与纹理容器。其 Python 工具可将车辆网格导出为 GLB 或 OBJ、纹理转为 DDS，并读取部分材质、配色、灯光和环境光遮蔽数据。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"cosmo-native-port-case","name":"Cosmo: a native port of Cosmo's Cosmic Adventure","name_zh":"Cosmo：Cosmo's Cosmic Adventure 原生移植版","url":"https://github.com/digows/cosmo","evidence_url":"https://github.com/digows/cosmo/blob/7844b9126c54f074e643e0d5806c69e1e382d94b/README.md","description_en":"Cosmo ports the reconstructed source of Cosmo's Cosmic Adventure: Forbidden Planet to macOS, Linux and Windows. It retains the game's logic and supplies an emulated EGA adapter, timer, keyboard controller, PC speaker and AdLib layer for the original code. The build uses the user's game data files.","description_zh":"Cosmo 将 Cosmo's Cosmic Adventure: Forbidden Planet 的重建源码移植到 macOS、Linux 和 Windows。项目保留游戏逻辑，另行实现 EGA、计时器、键盘控制器、PC 扬声器和 AdLib 的模拟层；构建时需由用户提供游戏数据文件。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"tuya-mobile-security-layer-case","name":"tuya-mobile: a Python reconstruction of Tuya app signing and API calls","name_zh":"tuya-mobile：Tuya 应用签名与 API 调用的 Python 重建","url":"https://github.com/AboveColin/tuya-mobile","evidence_url":"https://github.com/AboveColin/tuya-mobile/blob/86301173cb3c9fc543841f269805438151460dad/README.md","description_en":"tuya-mobile reconstructs Tuya mobile-app request signing, encrypted API calls and MQTT signaling credential derivation in Python. It replaces the app's native libthing_security.so signing step with HMAC-SHA256, SHA256 and MD5 calculations and includes versioned Smart Life and Tuya Smart profiles.","description_zh":"tuya-mobile 以 Python 重建 Tuya 移动应用的请求签名、加密 API 调用和 MQTT 信令凭据派生。它用 HMAC-SHA256、SHA256 和 MD5 计算替代应用原生 libthing_security.so 的签名步骤，并提供 Smart Life 与 Tuya Smart 的版本化配置。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-11-06"},{"id":"ed1ths-pvz-toolkit","name":"Ed1th's PvZ Toolkit","name_zh":"Ed1th's PvZ Toolkit 植物大战僵尸资源格式工具箱","url":"https://github.com/LambdaEd1th/ed1ths-pvz-toolkit","evidence_url":"https://github.com/LambdaEd1th/ed1ths-pvz-toolkit/blob/7eafbb4b3b1dbc9bf9a021c05be3bb7221d2e1ac/README.md","description_en":"Ed1th's PvZ Toolkit inspects and edits Plants vs. Zombies resource archives and files through a desktop or web interface backed by Rust format libraries. Its workspaces cover RSB/RSG, PAK and DZip archives, RTON and NEWTON data, PAM animation, Compiled Text and Wwise WEM audio, among other formats.","description_zh":"Ed1th's PvZ Toolkit 通过桌面或网页界面检查、编辑 Plants vs. Zombies 资源，底层使用 Rust 格式库。工作区涵盖 RSB/RSG、PAK、DZip 归档，RTON 与 NEWTON 数据、PAM 动画、Compiled Text 及 Wwise WEM 音频等格式。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"msi-mystic-light-b860-x870-linux-case","name":"MSI Mystic Light on Linux: reconstructing B860/X870 lighting control","name_zh":"MSI Mystic Light on Linux：重建 B860/X870 主板灯光控制","url":"https://github.com/Picachuchu69/msi-mystic-light-b860-x870-linux","evidence_url":"https://github.com/Picachuchu69/msi-mystic-light-b860-x870-linux/blob/166a622ef14f730ed457353f38670ced15a055a3/README.md","description_en":"MSI Mystic Light on Linux implements lighting control for an MSI motherboard from USB traffic captured while MSI Center ran in a Windows VM. Its Python script sends a 290-byte HID Feature report to controller 0db0:0076, while the documentation maps modes, RGB palette bytes, brightness, direction and the flash-save flag.","description_zh":"MSI Mystic Light on Linux 根据 Windows 虚拟机中捕获的 MSI Center USB 流量，实现 MSI 主板灯光控制。Python 脚本向 0db0:0076 控制器发送 290 字节 HID Feature 报文；文档标明模式、RGB 调色板、亮度、方向及写入闪存的字段。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"linkcam-case","name":"LinkCam: controlling Insta360 Link 2 through UVC extension research","name_zh":"LinkCam：研究 UVC 扩展控制并驱动 Insta360 Link 2","url":"https://github.com/fmontes/linkcam","evidence_url":"https://github.com/fmontes/linkcam/blob/f4c3d8726e58d72bc8fb59e20fd19ec74c95fb3a/CONTRIBUTING.md","description_en":"LinkCam implements macOS menu-bar and command-line controls for the Insta360 Link 2 webcam. It uses standard UVC controls for pan, tilt and zoom, while its extension-unit investigation identifies a feature-mask bit and selector for AI tracking.","description_zh":"LinkCam 为 Insta360 Link 2 摄像头提供 macOS 菜单栏应用和命令行控制。云台转向及变焦使用标准 UVC 控件；其扩展单元研究确定了 AI 追踪对应的功能位和选择器。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"shark-k86-mac-case","name":"shark-k86-mac: a client for the Attack Shark K86 HID protocol","name_zh":"shark-k86-mac：Attack Shark K86 HID 协议客户端","url":"https://github.com/RaphaelCaputo2/shark-k86-mac","evidence_url":"https://github.com/RaphaelCaputo2/shark-k86-mac/blob/f9c8910637e0f42ee6f51a530582077570f1abd9/PROTOCOL.md","description_en":"shark-k86-mac reconstructs the Attack Shark K86 keyboard's vendor HID controls as a Python CLI and library for macOS and Linux. Its clean-room protocol notes describe 64-byte feature reports, checksums and opcodes; the client controls lighting and the TFT screen and reads device information.","description_zh":"shark-k86-mac 将 Attack Shark K86 键盘的厂商 HID 控制协议实现为 macOS 和 Linux 上的 Python 命令行工具与库。其独立编写的协议文档记录 64 字节特性报告、校验和及操作码；客户端可控制灯效和 TFT 屏幕并读取设备信息。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"pcm-explorer","name":"PCM Explorer","name_zh":"PCM Explorer 车机镜像与固件分析工具","url":"https://github.com/dspl1236/PCM-Explorer","evidence_url":"https://github.com/dspl1236/PCM-Explorer/blob/a38709a0db90b9a3e70f4542b82553e93ace0f42/README.md","description_en":"PCM Explorer is a read-only Python browser for Porsche PCM and Audi MMI head-unit images. It parses QNX4/QNX6 drives, compressed firmware, update discs, persistence flash and HBM5 HMI files, and supports search, image comparison, extraction and filesystem checks.","description_zh":"PCM Explorer 是只读的 Python 车机镜像浏览器，面向 Porsche PCM 和 Audi MMI。它解析 QNX4/QNX6 磁盘、压缩固件、更新光盘、持久化闪存及 HBM5 界面文件，并提供搜索、镜像比较、提取和文件系统检查。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"tasm-rs","name":"tasm-rs","name_zh":"tasm-rs TVM 字节码反汇编与轨迹工具","url":"https://github.com/nktkt/tasm-rs","evidence_url":"https://github.com/nktkt/tasm-rs/blob/b9ed7d933e8fa1b8ff44b7246d9dffcfbd2f69a7/README.md","description_en":"tasm-rs implements TVM bytecode assembly and disassembly in Rust, with a tdisasm CLI, instruction tables, Fift parsing and trace and coverage reports. It uses checked-in conformance fixtures to compare output with the upstream TypeScript implementation; the author reports 959 matching fixtures.","description_zh":"tasm-rs 用 Rust 实现 TVM 字节码的汇编与反汇编，提供 tdisasm 命令行程序、指令表、Fift 解析及轨迹和覆盖率报告。项目用仓库内的对照样例与上游 TypeScript 实现比较；作者报告 959 个样例匹配。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"fitdays-protocol-case","name":"fitdays: reconstructing a smart-scale cloud client","name_zh":"fitdays：重建智能体脂秤云端客户端","url":"https://github.com/AboveColin/fitdays","evidence_url":"https://github.com/AboveColin/fitdays/blob/70684181540b0a6920984d4fe630d95e51514cd4/README.md","description_en":"fitdays recreates read-only access to the Fitdays smart-scale cloud API from traffic observed in the vendor app. Its asynchronous Python client logs in with the service's password digest, follows regional redirects, renews sessions, and retrieves scale, profile, and body-composition measurement records.","description_zh":"fitdays 根据对原应用流量的观察，重建 Fitdays 智能体脂秤云端 API 的只读访问。其异步 Python 客户端使用服务要求的密码摘要登录，处理区域重定向和会话续期，并读取体脂秤、成员档案及身体成分测量记录。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"trvision-case","name":"trvision: implementing Thermalright Vision USB display control","name_zh":"trvision：实现 Thermalright Vision USB 显示屏控制","url":"https://github.com/0iroN/trvision","evidence_url":"https://github.com/0iroN/trvision/blob/bc88670ac6b00a569d7228b083ef4badae987567/README.md","description_en":"trvision implements direct USB control of Thermalright Vision display panels using previously documented protocol research. It captures desktop frames, encodes JPEG or RGB565 according to the handshake reply, and sends framed data over bulk USB; a companion parser reads USBPcap captures.","description_zh":"trvision 依据已有协议研究实现 Thermalright Vision 显示屏的 USB 直连控制。程序采集桌面画面，按握手响应编码为 JPEG 或 RGB565，再通过 USB 批量传输发送；附带工具可解析 USBPcap 抓包。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"sogen-dart-bindings","name":"Sogen Dart bindings","name_zh":"Sogen Dart 可执行文件仿真绑定","url":"https://github.com/Wdestroier/sogen_dart","evidence_url":"https://github.com/Wdestroier/sogen_dart/blob/17a7b46c8532f6324e5bc948446a29bf9913aa0e/README.md","description_en":"Sogen Dart bindings expose Windows and Linux binary emulation through a Dart FFI package and native bridge. The API covers execution, snapshots, memory and registers, process views, callbacks and low-level hooks; Windows API calls and Linux symbols can also be intercepted. Its example hooks a Sleep call in an emulated executable.","description_zh":"Sogen Dart bindings 通过 Dart FFI 包和原生桥接层提供 Windows 与 Linux 可执行文件仿真。接口涵盖执行、快照、内存和寄存器、进程视图、回调及底层钩子，也支持拦截 Windows API 调用和 Linux 符号。示例展示了对仿真程序中 Sleep 调用的钩取。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"pocket-client-case","name":"pocket-client: a BLE client for the Pocket voice recorder","name_zh":"pocket-client：Pocket 录音笔的 BLE 客户端","url":"https://github.com/Enigma-Labs-Technology/pocket-client","evidence_url":"https://github.com/Enigma-Labs-Technology/pocket-client/blob/3386dae33289daa46bbdbff3b631766dd9267f39/README.md","description_en":"pocket-client implements the Pocket voice recorder's recovered BLE command protocol in a Swift library and CLI. It documents authentication, status and recording inventory exchanges, MP3 transfer and control commands, using findings from vendor-app HCI captures and live device probes.","description_zh":"pocket-client 以 Swift 库和命令行工具实现 Pocket 录音笔的 BLE 命令协议，记录鉴权、状态查询、录音列表、MP3 传输和录制控制报文。协议说明依据厂商应用的 HCI 抓包及设备探测。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"rofllens","name":"RoflLens","name_zh":"RoflLens《英雄联盟》回放协议分析工具","url":"https://github.com/ss26367098/rofllens","evidence_url":"https://github.com/ss26367098/rofllens/blob/62a475a8f05e7dfa94df5990758be2156c892496/README.md","description_en":"RoflLens is a Python library and CLI for analysing League of Legends ROFL v2 replay containers and network transport. It exports blocks and payloads, and offers patch-specific decoders for events such as movement, spells and deaths when the client version, protocol digest and executable hash match.","description_zh":"RoflLens 是分析《英雄联盟》ROFL v2 回放容器与网络传输的 Python 库和命令行工具。它可导出数据块及载荷；客户端版本、协议摘要和可执行文件哈希匹配时，可解码移动、施法、死亡等补丁相关事件。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["binary","game","protocol"],"verified_at":"2026-11-06"},{"id":"ddg-tenor-bridge-case","name":"ddg-tenor-bridge: replacing Gboard's Tenor search endpoint","name_zh":"ddg-tenor-bridge：替换 Gboard 的 Tenor 搜索端点","url":"https://github.com/hxreborn/ddg-tenor-bridge","evidence_url":"https://github.com/hxreborn/ddg-tenor-bridge/blob/fadbaf3b17bce31210121e06d410855d2cfb6e91/README.md","description_en":"ddg-tenor-bridge redirects Gboard's Tenor GIF searches to a service that returns DuckDuckGo animated-image results in Tenor v2 response form. Its documented workflow changes Gboard's persisted search URL flag while leaving other Tenor features on their original endpoint.","description_zh":"ddg-tenor-bridge 将 Gboard 的 Tenor GIF 搜索指向一个以 Tenor v2 响应格式返回 DuckDuckGo 动图结果的服务。文档说明如何修改 Gboard 保存的搜索地址标志，同时让其他 Tenor 功能继续使用原端点。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-11-06"},{"id":"keyaxis-keyboard-hid-case","name":"KeyAxis: decoding a magnetic keyboard's analog HID stream","name_zh":"KeyAxis：解析磁轴键盘的模拟量 HID 数据流","url":"https://github.com/RigZeeel/KeyAxis","evidence_url":"https://github.com/RigZeeel/KeyAxis/blob/53a7e1b267083ce8a979aea95635a4391962020a/PROTOCOL.md","description_en":"KeyAxis documents the HID travel stream of keyboards using the 0416:7372 controller and turns key depth into virtual gamepad axes. Its protocol notes specify the vendor interface, ARM and DISARM commands, 64-byte host reports and row, column and depth fields recovered from captured traffic.","description_zh":"KeyAxis 记录使用 0416:7372 控制器的键盘 HID 键程数据流，并将按键深度映射到虚拟手柄轴。协议文档说明厂商接口、ARM 与 DISARM 命令、64 字节主机消息，以及从抓包中还原的行、列和深度字段。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"kenshi-modkit","name":"kenshi-modkit","name_zh":"kenshi-modkit《Kenshi》文件格式工具包","url":"https://github.com/LucasSKrewer/kenshi-modkit","evidence_url":"https://github.com/LucasSKrewer/kenshi-modkit/blob/e1f22ce0f1f5610dbb66de83aeeffe5a5d2b9120/README.md","description_en":"kenshi-modkit parses and writes Kenshi .mod and .base files and reads its .save, .zone and .platoon files using Python. Its format notes document filetypes 15–17 and inferred typecodes, while utilities dump records, compare saves, detect mod conflicts and check byte-identical round trips.","description_zh":"kenshi-modkit 用 Python 解析和写入《Kenshi》的 .mod、.base 文件，并读取 .save、.zone、.platoon 存档。格式文档记录 filetype 15–17 与推断出的 typecode；附带记录导出、存档比较、模组冲突检测和字节一致性往返校验工具。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"aosmith-water-heater-case","name":"A.O. Smith water heater: local CTA-2045 control and protocol findings","name_zh":"A.O. Smith 热水器：CTA-2045 本地控制与协议研究","url":"https://github.com/ericboehs/aosmith-water-heater","evidence_url":"https://github.com/ericboehs/aosmith-water-heater/blob/4145daaf0f85bfdc19e96482e2ef4442721fb43a/README.md","description_en":"The A.O. Smith water-heater project implements local monitoring and demand-response control of an HPS10-50H45DV over its CTA-2045 RS-485 port, publishing readings to MQTT. Its documentation records frame structure, checksums, control responses and observed behavior of this specific tank.","description_zh":"该项目通过 HPS10-50H45DV 热水器的 CTA-2045 RS-485 端口实现本地监测与需求响应控制，并将读数发布到 MQTT。文档记录帧结构、校验和、控制应答及该型号热水器的实测行为。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"j2208-band-tools-case","name":"j2208-band-tools: a direct client for the J2208 fitness-band protocol","name_zh":"j2208-band-tools：基于 J2208 手环协议的直连客户端","url":"https://github.com/brendangooden/j2208-band-tools","evidence_url":"https://github.com/brendangooden/j2208-band-tools/blob/62ce48357e25d1c68e4c3e0bfd8d2cf1bbd745e9/PROTOCOL.md","description_en":"j2208-band-tools implements a direct BLE client for J2208-family fitness bands using protocol findings recovered from the FitTrack Health companion app. Its Python tools read stored health history and live sensor values, probe GATT services and collect readings into SQLite. The author checked the documented 16-byte frame protocol against one Hume Band V2.","description_zh":"j2208-band-tools 根据从 FitTrack Health 配套应用恢复的协议，实现 J2208 系列健身手环的直连 BLE 客户端。Python 工具可读取历史健康记录与实时传感器数据、探测 GATT 服务，并将采集结果存入 SQLite。作者在一只 Hume Band V2 上核对了文档所述的 16 字节帧协议。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"eufy-local-ha-case","name":"Eufy Local Light: reconstructing BLE control for E10 and E22 lights","name_zh":"Eufy Local Light：重建 E10 与 E22 灯具的 BLE 控制","url":"https://github.com/SudoSaturn/eufy-local-ha","evidence_url":"https://github.com/SudoSaturn/eufy-local-ha/blob/4f2164281977000754611dd35e144d45858a8b96/PROTOCOL.md","description_en":"Eufy Local Light implements a Home Assistant client for Eufy Outdoor String Lights E10 and Permanent Outdoor Lights E22 using BLE traffic analyzed from the Eufy app. Its protocol notes describe GATT endpoints, packet framing, AES-128-CBC session setup, and light-control commands.","description_zh":"Eufy Local Light 根据对 Eufy 应用 BLE 流量的分析，为 E10 串灯和 E22 户外灯实现 Home Assistant 本地控制。协议笔记记录了 GATT 端点、数据包格式、AES-128-CBC 会话建立和灯具控制命令。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"openpeats-case","name":"OpenPeats: reconstructing SoundPEATS earbud controls","name_zh":"OpenPeats：重建 SoundPEATS 耳机控制协议","url":"https://github.com/Wasabules/OpenPeats","evidence_url":"https://github.com/Wasabules/OpenPeats/blob/8e8357d6054e5bb2244241313ad6491f55692a76/README.md","description_en":"OpenPeats reconstructs the SoundPEATS earbud control protocol for desktop and Android clients. Its specification describes frames and opcodes derived from analysis of the official Android app and checked against SOUNDPEATS H3 hardware. Go and Kotlin implementations expose ANC, equalizer and multipoint controls, plus battery status.","description_zh":"OpenPeats 重建 SoundPEATS 耳机控制协议，并实现桌面端和 Android 客户端。协议文档记录了从官方 Android 应用分析得出的帧格式与操作码，以及在 SOUNDPEATS H3 上的通信核对结果；Go 和 Kotlin 实现提供降噪、均衡器和多点连接控制，并读取电池电量。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"hongtai-panel-case","name":"hongtai-panel: reconstructing a cooler LCD's USB serial protocol","name_zh":"hongtai-panel：还原水冷显示屏的 USB 串口协议","url":"https://github.com/GOG1071/hongtai-panel","evidence_url":"https://github.com/GOG1071/hongtai-panel/blob/121634c3e7f647b70d705008834884ac0baba994/README.md","description_en":"hongtai-panel implements Linux control of a LovingCool AIO cooler LCD using a USB CDC-ACM serial protocol reconstructed from the vendor's Electron application. Its documentation describes control-frame layout, checksums, JSON replies, and opcodes; the client displays system statistics, media, or screen mirroring.","description_zh":"hongtai-panel 从厂商 Electron 应用还原 USB CDC-ACM 串口协议，为 LovingCool 一体式水冷显示屏提供 Linux 控制程序。文档列出控制帧、校验和、JSON 回复及操作码；客户端可显示系统状态、媒体内容或屏幕镜像。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"emotion-control-ha-case","name":"ESPHome ↔ L&S Emotion Control: reconstructing a smart-light radio client","name_zh":"ESPHome ↔ L&S Emotion Control：重建智能灯无线控制客户端","url":"https://github.com/SergeyZh/emotion-control-ha","evidence_url":"https://github.com/SergeyZh/emotion-control-ha/blob/05134b32b007277695badfb360f3439dc7f9348c/README.md","description_en":"An ESPHome component recreates L&S Emotion Control remote commands so an ESP32 with a CC2500 radio can control furniture lights and reflect physical remote presses in Home Assistant. Its documented radio configuration uses MSK at 2436.2 MHz, a sync word, and 14-byte payloads carrying the remote ID, command, and value.","description_zh":"该 ESPHome 组件让 ESP32 配合 CC2500 无线模块重现 L&S Emotion Control 遥控命令，在 Home Assistant 中控制灯具并同步实体遥控器操作。文档记录了 2436.2 MHz 的 MSK 参数、同步字，以及包含遥控器 ID、命令和值的 14 字节载荷。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"akp02-display-protocol-case","name":"akp02: reconstructing the Ajazz AKP02 display protocol","name_zh":"akp02：重建 Ajazz AKP02 显示屏协议","url":"https://github.com/deonspengler/akp02","evidence_url":"https://github.com/deonspengler/akp02/blob/ee4f4468573fad8d38f3012aac0ccbf1f9c0edcf/README.md","description_en":"akp02 reconstructs the Ajazz AKP02 secondary display's USB HID protocol as a Linux Python library. It documents command report framing and implements full or partial image updates, brightness and power controls, firmware queries, orientation and keepalive.","description_zh":"akp02 将 Ajazz AKP02 副屏的 USB HID 协议重建为 Linux Python 库。文档记录命令报告格式，代码实现整屏与局部图像更新、亮度和电源控制、固件查询、方向设置及保活。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"cupertino-files","name":"cupertino-files","name_zh":"cupertino-files iWork 文档格式工具包","url":"https://github.com/den-frie-vilje/cupertino-files","evidence_url":"https://github.com/den-frie-vilje/cupertino-files/blob/9550fc8163c64774f4400b98e0542823da59f8b6/README.md","description_en":"cupertino-files is a TypeScript library for reading and writing modern Apple Pages, Numbers, and Keynote documents. It models their undocumented file structures from real documents, exposes editing APIs and CLI tools, and publishes format notes and a language-neutral conformance suite.","description_zh":"cupertino-files 是读写现代 Apple Pages、Numbers 和 Keynote 文档的 TypeScript 库。它通过实际文档研究未公开的文件结构，提供编辑 API、命令行工具、格式说明及跨语言一致性测试集。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"l4d2-director-research-case","name":"Left 4 Dead 2: recovering the AI Director's behavior","name_zh":"Left 4 Dead 2：还原 AI Director 的运行机制","url":"https://github.com/zeljkovranjes/l4d2-director-system-research","evidence_url":"https://github.com/zeljkovranjes/l4d2-director-system-research/blob/e646012ed9176d8691ff106c9643995a6bfa19c1/README.md","description_en":"This Left 4 Dead 2 study reconstructs the AI Director's pacing, intensity, encounter placement and music rules from an identified x86 server.dll and sanitized runtime traces. It publishes disassembly-derived findings, analysis scripts, evidence files and implementation specifications; a reference game library is in a separate repository.","description_zh":"这项 Left 4 Dead 2 研究依据指定的 x86 server.dll 和脱敏运行轨迹，还原 AI Director 的节奏、强度、遭遇布置及音乐规则。仓库提供基于反汇编的发现、分析脚本、证据文件和实现规格；参考游戏库位于另一仓库。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game"],"verified_at":"2026-11-06"},{"id":"msp-csv-format-case","name":"MSP CSV Export Format: reconstructing My Stocks Portfolio exports","name_zh":"MSP CSV Export Format：My Stocks Portfolio 导出格式重建","url":"https://github.com/Izero/msp-csv-format","evidence_url":"https://github.com/Izero/msp-csv-format/blob/d666b16d0f1d2501680204436dfdf1a64c3c2096/README.md","description_en":"MSP CSV Export Format reconstructs the undocumented CSV export of the My Stocks Portfolio & Market app. The author compared eleven iOS exports, app displays and public translation strings to describe columns, blocks and transaction replay. A dependency-free Python parser and synthetic export exercise the documented rules and flag malformed input.","description_zh":"MSP CSV Export Format 还原 My Stocks Portfolio & Market 应用未公开的 CSV 导出格式。作者对照十一份 iOS 导出文件、应用显示内容和公开翻译字符串，整理列、数据块及交易重放规则；仓库提供无第三方依赖的 Python 解析器和合成样例，用于检查格式规则及异常输入。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-11-06"},{"id":"mechrewired-mechwarrior-2-case","name":"MechRewired: rebuilding MechWarrior 2 from original game data","name_zh":"MechRewired：基于原版数据重建 MechWarrior 2","url":"https://github.com/deanthecoder/MechRewired","evidence_url":"https://github.com/deanthecoder/MechRewired/blob/2151bcea58d5447436cb9362eca9d6f8a987493e/README.md","description_en":"MechRewired rebuilds the MechWarrior 2: 31st Century Combat experience around data imported from a user's DOS copy. Its code loads original resources and missions, while providing a new cockpit, terrain rendering and combat simulation for modern platforms.","description_zh":"MechRewired 利用用户 DOS 版《MechWarrior 2: 31st Century Combat》的数据重建游戏体验。项目代码加载原版资源和任务，并为现代平台实现新的驾驶舱、地形渲染与战斗模拟。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"nrf52-eink-price-tag-case","name":"nRF52 e-paper tag: reconstructing an undocumented display interface","name_zh":"nRF52 e-paper tag：重建无文档电子纸显示接口","url":"https://github.com/niazlv/nrf52-eink-price-tag","evidence_url":"https://github.com/niazlv/nrf52-eink-price-tag/blob/ac789f2f103a1d9da4054076496d0921379e5a0b/README.md","description_en":"nRF52 e-paper tag reconstructs control of an undocumented electronic shelf label with an nRF52832 board and SSD1675A-class panel. The repository records the pinout, 9-bit SPI connection, waveform-table layout and refresh behavior, and provides replacement Zephyr firmware plus a portable C99 display driver.","description_zh":"nRF52 e-paper tag 重建采用 nRF52832 电路板和 SSD1675A 类面板的无文档电子价签控制方式。仓库记录引脚、9 位 SPI 连接、波形表结构及刷新行为，并提供替代 Zephyr 固件和可移植的 C99 显示驱动。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","protocol"],"verified_at":"2026-11-06"},{"id":"benro-polaris-firmware-patcher-case","name":"Benro Polaris Firmware Patcher: rebuilding camera control and mapping the app protocol","name_zh":"Benro Polaris Firmware Patcher：重建相机控制并解析应用协议","url":"https://github.com/blaineam/benro-polaris-firmware-patcher","evidence_url":"https://github.com/blaineam/benro-polaris-firmware-patcher/blob/6bbf67a8b762a9926a42da0f5444f0c0364ff9f0/README.md","description_en":"Benro Polaris Firmware Patcher investigates the Polaris camera controller and repacks a user-supplied firmware image with a newer libgphoto2 stack and targeted pgphoto changes. Its documentation maps Benro Connect app behavior and the TCP messages used to control the device. The author reports end-to-end testing with a Canon EOS R5 Mark II.","description_zh":"Benro Polaris Firmware Patcher 研究 Polaris 相机控制器，将新版 libgphoto2 组件和针对 pgphoto 的修改打包进用户自备固件镜像。文档还梳理 Benro Connect 应用行为及其控制设备的 TCP 报文。作者报告已使用 Canon EOS R5 Mark II 完成端到端测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","firmware","protocol"],"verified_at":"2026-11-06"},{"id":"rk-m75-case","name":"RK M75: reconstructing wired and wireless RGB control","name_zh":"RK M75：复现有线与无线 RGB 灯光控制","url":"https://github.com/Lightning-13/rk-m75","evidence_url":"https://github.com/Lightning-13/rk-m75/blob/abf286541b096da2a62360ec7b12035babc007d0/README.md","description_en":"RK M75 reconstructs RGB control for the Royal Kludge RK M75 keyboard from wired USB HID captures and 2.4 GHz wireless experiments. A Python library sends per-key wired frames and grouped wireless frames; the repository also contains protocol notes, captures and a wired SignalRGB plugin.","description_zh":"RK M75 通过有线 USB HID 抓包和 2.4 GHz 无线实验，复现 Royal Kludge RK M75 键盘的 RGB 灯光控制。Python 库可发送有线逐键颜色帧和无线分组颜色帧；仓库还收录协议笔记、抓包及有线 SignalRGB 插件。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"d2mac-linux-case","name":"d2mac-linux: porting the Diablo II Mac executable to 32-bit Linux","name_zh":"d2mac-linux：将《Diablo II》Mac 可执行文件移植到 32 位 Linux","url":"https://github.com/jaenster/d2mac-linux","evidence_url":"https://github.com/jaenster/d2mac-linux/blob/313fa1c5b8c05c14f5aeebc05904fced222633d0/README.md","description_en":"d2mac-linux ports the Diablo II 1.14d Mac executable to 32-bit Linux by converting its i386 Mach-O container to ELF and reimplementing imported Darwin, Carbon and AGL interfaces in Zig. The shim translates graphics to GLX and adapts threading, files and sockets. The author reports that the game reaches its menu and character creation.","description_zh":"d2mac-linux 将《Diablo II》1.14d Mac 版 i386 Mach-O 转为 ELF，并用 Zig 重写所需的 Darwin、Carbon 和 AGL 导入接口，使其移植到 32 位 Linux。兼容层将图形调用转为 GLX，并适配线程、文件与套接字；作者报告游戏可进入主菜单并创建角色。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game"],"verified_at":"2026-11-06"},{"id":"packerscope","name":"PackerScope","name_zh":"PackerScope PE 加壳分析框架","url":"https://github.com/salmanmallah/packerscope","evidence_url":"https://github.com/salmanmallah/packerscope/blob/db2ea6db6105ce45decd0fef0c01f16d87dc7225/README.md","description_en":"PackerScope scans Windows PE executables for packer signatures and structural indicators, including entropy, sections, imports and entry-point instructions. It can invoke supported unpackers and check PE integrity, entropy and import-table recovery before generating reports.","description_zh":"PackerScope 检查 Windows PE 可执行文件的熵、节区、导入表、入口指令和加壳签名。对受支持的文件可执行脱壳，并检查 PE 结构、熵及导入表恢复情况，随后生成报告。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"aciq-minisplit-protocol-case","name":"ACiQ K18W: reconstructing a mini split's UART protocol","name_zh":"ACiQ K18W：还原分体空调 UART 协议","url":"https://github.com/codypendant/aciq-minisplit-protocol","evidence_url":"https://github.com/codypendant/aciq-minisplit-protocol/blob/fe8a3cf59fdfc0f83d4cd65907962b2146c45188/README.md","description_en":"ACiQ K18W documents the UART protocol between a mini split's indoor board and TCL WBR1 Wi-Fi module. Captures and decoders map 115200 8N1 traffic, 0xA5 frames, CRC-16/XMODEM, acknowledgments, and appliance fields; ESPHome configurations provide passive monitoring or local control after replacing the module.","description_zh":"ACiQ K18W 记录分体空调室内板与 TCL WBR1 Wi-Fi 模块之间的 UART 协议。抓包和解码器说明 115200 8N1 通信、0xA5 帧、CRC-16/XMODEM、确认消息及设备字段；ESPHome 配置支持被动监听，或在替换模块后进行本地控制。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"rnd-companion-case","name":"RND Companion: reconstructing the RND Synth SysEx protocol","name_zh":"RND Companion：重建 RND Synth 的 SysEx 协议","url":"https://github.com/Enkerli/rnd-companion","evidence_url":"https://github.com/Enkerli/rnd-companion/blob/f98ebb811974e01970f00e0c4a0dd04557913ac2/docs/PROTOCOL.md","description_en":"RND Companion reconstructs the Cymaforma RND Synth's SysEx control vocabulary and implements a C++ codec and companion plugin for patch seeds. The protocol notes identify framing and seed or status commands from a web app and one hardware capture. The client can use a direct MIDI port or host MIDI routing and stores a curated seed library.","description_zh":"RND Companion 重建 Cymaforma RND Synth 的 SysEx 控制命令，并提供 C++ 编解码器和管理音色种子的配套插件。协议笔记根据网页应用及一段实机 MIDI 录制数据记录帧格式、种子命令和状态命令；客户端支持直连 MIDI 端口或通过宿主软件路由 MIDI，并保存音色种子库。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"imprint-pe-triage","name":"imprint","name_zh":"imprint PE 导入表静态分析工具","url":"https://github.com/hamodywe/imprint","evidence_url":"https://github.com/hamodywe/imprint/blob/b63df337336333e9db566144fdb8ffea056c6a89/README.md","description_en":"imprint analyzes Windows PE files by parsing import, delay-import and export directories without executing the image. It maps imported Windows APIs to categories and MITRE ATT&CK techniques, then reports capability patterns with the imports that triggered each finding in text or JSON.","description_zh":"imprint 不执行映像，直接解析 Windows PE 文件的导入、延迟导入和导出目录。它把导入的 Windows API 映射到行为类别与 MITRE ATT&CK 技术，再以文本或 JSON 输出能力模式及触发依据。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"spider-man-2-ps2-recomp-case","name":"Spider-Man 2 PS2 Recomp: a static recompilation checkpoint","name_zh":"Spider-Man 2 PS2 Recomp：《Spider-Man 2》静态重编译阶段成果","url":"https://github.com/saltyboosack-blip/Spider-Man-2-PS2-Recomp","evidence_url":"https://github.com/saltyboosack-blip/Spider-Man-2-PS2-Recomp/blob/98aef964411fc355ff4ae59a710b1644222bfe6c/README.md","description_en":"Spider-Man 2 PS2 Recomp applies static recompilation to the USA PlayStation 2 release SLUS-20776 for native PC execution. It combines a game-specific Ghidra function map with PS2Recomp source, runtime fixes and hardware comparison tests. The author reports that a native Windows build reaches the legal splash; the port is not playable.","description_zh":"Spider-Man 2 PS2 Recomp 对美版 PS2 游戏 SLUS-20776 进行静态重编译，目标是在 PC 上原生运行。仓库包含针对游戏的 Ghidra 函数映射、PS2Recomp 源码、运行时修复和硬件行为对照测试。作者报告 Windows 构建已到达版权画面，但仍不能游玩。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"ffxii-tza-tools","name":"ffxii-tza-tools","name_zh":"ffxii-tza-tools 最终幻想 XII 文件格式工具","url":"https://github.com/StyuDEV/ffxii-tza-tools","evidence_url":"https://github.com/StyuDEV/ffxii-tza-tools/blob/537fb89be76a19176014d414bf3e58d1170a0198/README.md","description_en":"ffxii-tza-tools documents and processes FINAL FANTASY XII The Zodiac Age character formats, including .ca animations, .cm models and .phyre assets. Its Python tools decode chunk structures, export models and animations to glTF, edit curves and repack @FRP containers from files extracted from the user’s game copy.","description_zh":"ffxii-tza-tools 记录并处理 FINAL FANTASY XII The Zodiac Age 的角色文件格式，包括 .ca 动画、.cm 模型和 .phyre 资源。Python 工具可解析分块结构、将模型与动画导出为 glTF、编辑曲线，并根据用户自行提取的游戏文件重新打包 @FRP 容器。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"sims-package2glb","name":"sims-package2glb","name_zh":"sims-package2glb：《模拟人生》package 格式提取工具","url":"https://github.com/infinition/sims-package2glb","evidence_url":"https://github.com/infinition/sims-package2glb/blob/907c3d4c2cabac133e00520eb9a78a2516beca23/README.md","description_en":"sims-package2glb extracts models from The Sims 2, 3 and 4 .package files into glTF binary files. Its Rust parsers handle DBPF containers, RefPack compression, RCOL and GMDC geometry, textures, materials and recolours. The documentation records format findings including Sims 4 DST texture planes and relative RCOL chunk references.","description_zh":"sims-package2glb 将《模拟人生》2、3、4 的 .package 模型资源导出为 glTF 二进制文件。Rust 解析器处理 DBPF 容器、RefPack 压缩、RCOL 与 GMDC 几何、纹理、材质和换色版本。文档还记录了 Sims 4 的 DST 纹理平面及 RCOL 相对块引用等格式发现。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"reverse-workbench-skill","name":"reverse-workbench-skill","name_zh":"reverse-workbench-skill 逆向分析技能路由包","url":"https://github.com/Asaiuta/reverse-workbench-skill","evidence_url":"https://github.com/Asaiuta/reverse-workbench-skill/blob/6aa36c1c00cd84f1749bf983ca282d533ba77266/README.md","description_en":"reverse-workbench-skill is a multi-agent-harness skill bundle that routes investigations to workflows for APKs, native binaries, firmware, frontend JavaScript, and network traffic. Its documented paths include Ghidra headless exports, binary diffing, and evidence recording, alongside broader security-analysis skills and helper scripts.","description_zh":"reverse-workbench-skill 是适用于多种智能体环境的技能包，将 APK、原生二进制、固件、前端 JavaScript 和网络流量调查分派到对应流程。文档列出 Ghidra 无界面导出、二进制差异分析和证据记录路径，也包含其他安全分析技能及辅助脚本。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["app","binary","firmware","website"],"verified_at":"2026-11-06"},{"id":"vc64-240p","name":"vc64_240p","name_zh":"vc64_240p Wii N64 虚拟主机视频补丁工具","url":"https://github.com/kreycai/vc64_240p","evidence_url":"https://github.com/kreycai/vc64_240p/blob/a4635b3fd451e2ce53c05a67ed124603d02fb9fe/README.md","description_en":"vc64_240p analyses and patches the N64 Virtual Console emulator inside Wii WAD channels to output 240p. It finds render-mode structures by pattern, changes video fields and disables deflicker; an optional patch removes the emulator's dark filter.","description_zh":"vc64_240p 分析并修改 Wii WAD 频道中的 N64 Virtual Console 模拟器，使其输出 240p。工具按结构特征定位视频模式表、调整显示字段并关闭防闪烁滤镜，还可选择移除暗化滤镜。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-11-06"},{"id":"rtg-format","name":"RtG-Format","name_zh":"RtG-Format Road To Gramby's 存档格式文档","url":"https://github.com/JuanCrakYT/RtG-Format","evidence_url":"https://github.com/JuanCrakYT/RtG-Format/blob/8199b79948f0fd2de8c787f8a58e678f27e16feb/README.md","description_en":"RtG-Format documents the observed save and construction format of the Roblox game Road To Gramby's. Its references and experiments cover build structures, part identifiers, connections, properties, encoding and compression, with supporting CLI and browser preview tools.","description_zh":"RtG-Format 记录 Roblox 游戏 Road To Gramby's 的存档与建造格式。文档和实验涵盖建造结构、部件标识、连接关系、属性、编码与压缩，并附命令行工具和浏览器预览器。","kind":"documentation","category":"game-analysis","group":"learn","relationship":"learning","targets":["game"],"verified_at":"2026-11-06"},{"id":"fl-studio-stealer-analysis-case","name":"Malware Analysis: a trojanized FL Studio installer and Go stealer","name_zh":"Malware Analysis：木马化 FL Studio 安装包与 Go 窃密程序分析","url":"https://github.com/AllobatesZaparo/malware-analysis","evidence_url":"https://github.com/AllobatesZaparo/malware-analysis/blob/2ab3ceacbfa239048a4892d51089d1b926dea4d2/fl-studio-stealer/README.md","description_en":"This malware-analysis report investigates a trojanized FL Studio installer that bundles an Electron/NSIS wrapper and a Go information stealer. The author traces the wrapper statically and studies the payload in an isolated Windows environment with process, registry and network observations, recovering its reported command-and-control mechanism.","description_zh":"这份恶意软件分析报告研究一个木马化的 FL Studio 安装包，其中包含 Electron/NSIS 包装程序和 Go 信息窃取载荷。作者通过静态检查追踪安装流程，并在隔离的 Windows 环境中结合进程、注册表和网络记录研究载荷，报告了所恢复的命令控制机制。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","binary"],"verified_at":"2026-11-06"},{"id":"mindnode-mcp","name":"MindNode MCP Server","name_zh":"MindNode MCP Server 思维导图智能体接口","url":"https://github.com/jyuwaaw/mindnode-mcp","evidence_url":"https://github.com/jyuwaaw/mindnode-mcp/blob/634bfe96e443aa2e3147b9d7a86ba3991d366d65/README.md","description_en":"MindNode MCP Server connects agents to MindNode Next mind maps on macOS. Its reader decodes the app's SQLite library, protobuf snapshots, Apple LZ4 compression and CRDT operations into Markdown outlines; other MCP tools return previews or create maps through MindNode's Markdown importer.","description_zh":"MindNode MCP Server 让智能体访问 macOS 上的 MindNode Next 思维导图。读取流程解析应用的 SQLite 资料库、protobuf 快照、Apple LZ4 压缩数据和 CRDT 操作，输出 Markdown 大纲；其他 MCP 工具可读取预览图或通过应用的 Markdown 导入器新建导图。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app"],"verified_at":"2026-11-06"},{"id":"touhou-engine-case","name":"touhou-engine: a Python reimplementation of Touhou gameplay","name_zh":"touhou-engine：用 Python 重实现东方游戏玩法","url":"https://github.com/SaigyoujYuyuko/touhou-engine","evidence_url":"https://github.com/SaigyoujYuyuko/touhou-engine/blob/6d12df8dc57b66766c311ea299d0b257410765ef/README.md","description_en":"touhou-engine reimplements Touhou danmaku gameplay in Python, with TH07: Perfect Cherry Blossom as its reference game. The author says its engine logic was ported frame by frame against a decompilation, while the new architecture supplies an event stream, replay handling, headless stepping, and a pygame renderer. It reads original game archives supplied by the user.","description_zh":"touhou-engine 用 Python 重实现东方弹幕游戏玩法，以 TH07《东方妖妖梦》为参考作品。作者称引擎逻辑对照原版反编译结果逐帧移植，新架构提供事件流、录像处理、无界面逐帧运行和 pygame 渲染，并读取使用者提供的原版游戏资源包。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"viture-v2-case","name":"viture-v2: a reconstructed VITURE Gen2 glasses protocol and driver","name_zh":"viture-v2：VITURE Gen2 眼镜协议与驱动重建","url":"https://github.com/elasticjava/viture-v2","evidence_url":"https://github.com/elasticjava/viture-v2/blob/8b29df0667cd65f0af8293b72c1c97ec959213bd/PROTOCOL.md","description_en":"viture-v2 documents and implements the USB HID protocol used by VITURE Gen2 XR glasses. The author matched usbmon captures to SDK frame logs, then wrote a Rust driver with hidraw, usbfs and io_uring transports for queries and IMU streams. Measurements and compatibility claims cover the VITURE Pro 2 XR.","description_zh":"viture-v2 记录并实现 VITURE Gen2 XR 眼镜的 USB HID 协议。作者将 usbmon 抓包与 SDK 帧日志对照，编写了支持 hidraw、usbfs 和 io_uring 的 Rust 驱动，用于设备查询与 IMU 数据流；实测对象为 VITURE Pro 2 XR。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"bikestation-case","name":"BikeStation: local Echelon Connect control over Bluetooth LE","name_zh":"BikeStation：通过蓝牙 LE 本地控制 Echelon Connect 健身车","url":"https://github.com/nathanbrittin/BikeStation","evidence_url":"https://github.com/nathanbrittin/BikeStation/blob/690d805a1001e8681e02125db44099d464c3d682/README.md","description_en":"BikeStation is a local Windows client for Echelon Connect exercise bikes built on community research into their proprietary Bluetooth LE protocol. It reads cadence and resistance telemetry, queries the bike's resistance range, writes motorized resistance commands and records rides without the vendor cloud.","description_zh":"BikeStation 是用于 Echelon Connect 健身车的本地 Windows 客户端，基于社区对其专有低功耗蓝牙协议的研究。它读取踏频和阻力数据、查询阻力范围、向电动阻力机构发送控制命令，并在无需厂商云服务的情况下将骑行记录保存在本地。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"grsimwrite-mac-case","name":"grsimwrite-mac: reconstructing GRSIMWrite for macOS","name_zh":"grsimwrite-mac：重建适用于 macOS 的 GRSIMWrite","url":"https://github.com/eliel9012/grsimwrite-mac","evidence_url":"https://github.com/eliel9012/grsimwrite-mac/blob/280c56527747a4ab3b720db550edac84e9046ecd/README.md","description_en":"grsimwrite-mac reconstructs the Windows GRSIMWrite 4.4.10 SIM-writing workflow in Python for macOS. Its research records card-family profiles and APDU write behavior, while the implementation identifies cards, reads elementary files, writes selected fields, and builds formatting sequences.","description_zh":"grsimwrite-mac 用 Python 为 macOS 重建 Windows 工具 GRSIMWrite 4.4.10 的 SIM 写卡流程。研究资料记录卡片家族配置和 APDU 写入行为；实现提供卡片识别、EF 读取、字段写入及格式化指令序列生成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-11-06"},{"id":"kdemulator","name":"kdemulator","name_zh":"kdemulator Windows 内核驱动模拟分析工具","url":"https://github.com/000nico/kdemulator","evidence_url":"https://github.com/000nico/kdemulator/blob/44c05218b4b83d8a864df540aead218dbdf48e6a/README.md","description_en":"kdemulator executes Windows x86-64 kernel-driver binaries outside a live kernel for IOCTL analysis. It maps PE sections into Unicorn, intercepts imported NT API calls and supplies minimal kernel-object and memory stubs. The CLI can invoke DriverEntry, send one IOCTL or run a mutation loop over an IOCTL input buffer.","description_zh":"kdemulator 在真实内核之外执行 Windows x86-64 内核驱动二进制文件，以分析 IOCTL。它将 PE 节映射到 Unicorn，截获导入的 NT API 调用，并提供最小化的内核对象与内存模拟；命令行可运行 DriverEntry、发送单次 IOCTL 或循环变异输入。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"angr-management","name":"angr-management","name_zh":"angr-management 图形化二进制分析工具","url":"https://github.com/angr/angr-management","evidence_url":"https://github.com/angr/angr-management/blob/1af4c02877c0ada70b457b4e321da07a912e4b6f/README.md","description_en":"Cross-platform graphical binary analysis tool powered by the angr platform, with disassembly and decompilation views.","description_zh":"基于 angr 平台的跨平台图形化二进制分析工具，提供反汇编和反编译视图。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"qira","name":"QIRA","name_zh":"QIRA 执行轨迹分析工具","url":"https://github.com/geohot/qira","evidence_url":"https://github.com/geohot/qira/blob/5f34406410aa492bc491fe0e579dbe103390a432/README.md","description_en":"QIRA is a tool for examining program execution traces. Its interface lets users navigate instruction changes, register values, memory reads and writes, and forks.","description_zh":"QIRA 是用于查看程序执行轨迹的工具。用户可以通过界面浏览指令变化、寄存器值、内存读写和执行分支。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"dependencies-pe","name":"Dependencies","name_zh":"Dependencies Windows PE 依赖分析工具","url":"https://github.com/lucasg/Dependencies","evidence_url":"https://github.com/lucasg/Dependencies/blob/1997a40000b77bd3326cbc33672a7b9f78bb23f3/README.md","description_en":"Dependencies is a Windows PE dependency analysis tool with command-line and graphical interfaces. It shows imports, exports, and DLL load dependencies to help diagnose loading problems.","description_zh":"Dependencies 是一款提供命令行和图形界面的 Windows PE 依赖分析工具。它可显示导入、导出及 DLL 加载依赖，帮助排查加载问题。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"dnlib","name":"dnlib","name_zh":"dnlib .NET 程序集读写库","url":"https://github.com/0xd4d/dnlib","evidence_url":"https://github.com/0xd4d/dnlib/blob/9871d3b290589a9316dc68439d1c5307411d5dc5/README.md","description_en":"dnlib is a .NET library for reading and writing modules and assemblies. It provides access to metadata, method bodies, resources, and PDB files.","description_zh":"dnlib 是用于读取和写入 .NET 模块及程序集的库。它提供对元数据、方法体、资源和 PDB 文件的访问能力。","kind":"tool","category":"dotnet","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"hachoir","name":"Hachoir","name_zh":"Hachoir 二进制流查看与编辑库","url":"https://github.com/vstinner/hachoir","evidence_url":"https://github.com/vstinner/hachoir/blob/685b2986dee5ea53b450636cddfd0217cfde080c/README.rst","description_en":"Hachoir is a Python library for viewing and editing binary streams as trees of fields, down to individual bits. Its command-line tools can search binary files for text, extract or remove metadata, and display file contents in text mode.","description_zh":"Hachoir 是一个 Python 库，可将二进制流按字段组织成树状结构，查看和编辑细至单个位的内容。其命令行工具可在二进制文件中搜索文本、提取或删除元数据，并以文本模式显示文件内容。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"pigaios","name":"Pigaios","name_zh":"Pigaios 源码与二进制匹配工具","url":"https://github.com/joxeankoret/pigaios","evidence_url":"https://github.com/joxeankoret/pigaios/blob/8807972f08d5613f5dd291329306abdfb68d60ec/README.md","description_en":"Pigaios is a tool that matches C source code against binaries in IDA. It extracts function features from source code, finds corresponding functions in an IDA database, and imports symbols, structures, and enumerations. It can work with partial source code that does not compile.","description_zh":"Pigaios 是一款在 IDA 中将 C 源代码与二进制文件进行匹配的工具。它从源码提取函数特征，在 IDA 数据库中查找对应函数，并导入符号、结构体和枚举。它也能处理无法完整编译的部分源码。","kind":"tool","category":"binary-diffing","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"machoexplorer","name":"MachOExplorer","name_zh":"MachOExplorer Mach-O 文件浏览器","url":"https://github.com/everettjf/machoexplorer","evidence_url":"https://github.com/everettjf/machoexplorer/blob/cd612d774369475efeb437377d91502c2b9602a5/README.md","description_en":"MachOExplorer is a desktop and command-line tool for inspecting Mach-O binaries, Universal binaries, static archives, and dyld shared caches. It displays file structures, symbols, disassembly, and Apple-specific metadata, and can export analysis as text or JSON.","description_zh":"MachOExplorer 是用于检查 Mach-O 二进制文件、Universal 二进制文件、静态归档和 dyld 共享缓存的桌面及命令行工具。它可展示文件结构、符号、反汇编结果和 Apple 平台特有的元数据，并以文本或 JSON 导出分析结果。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"me-cleaner","name":"me_cleaner","name_zh":"me_cleaner Intel ME 固件精简脚本","url":"https://github.com/corna/me_cleaner","evidence_url":"https://github.com/corna/me_cleaner/blob/41eba87c85a1f0d013790f12b649c2da5b35dcfa/README.md","description_en":"me_cleaner is a Python script that modifies Intel ME firmware images to reduce the firmware's ability to interact with the system. Depending on the ME generation, it removes the firmware or retains only modules needed for boot.","description_zh":"me_cleaner 是一个修改 Intel ME 固件映像的 Python 脚本，旨在减少该固件与系统交互的能力。根据 ME 的代际，它会移除固件，或仅保留启动所需的模块。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"flex-ios","name":"FLEX","name_zh":"FLEX iOS 应用内调试探索工具","url":"https://github.com/FLEXTool/FLEX","evidence_url":"https://github.com/FLEXTool/FLEX/blob/dac6130e0c7aca0bbf7ff8c0b57ba284776bfdff/README.md","description_en":"FLEX is an in-app tool for exploring and debugging running iOS applications. It can inspect and change views and object state, browse app files and databases, and show network request history.","description_zh":"FLEX 是用于探索和调试运行中 iOS 应用的应用内工具。它可以检查和修改视图及对象状态、浏览应用文件和数据库，并查看网络请求记录。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"classdump-dyld","name":"classdump-dyld","name_zh":"classdump-dyld 类头文件提取工具","url":"https://github.com/limneos/classdump-dyld","evidence_url":"https://github.com/limneos/classdump-dyld/blob/31b6f9d897ed12065d9d30cc3aba548c892407f5/readme.md","description_en":"classdump-dyld is a command-line tool that generates Objective-C headers from Mach-O app binaries, libraries, frameworks, bundles, and images in the dyld shared cache. It can dump a single class or process compatible files recursively.","description_zh":"classdump-dyld 是一款命令行工具，可从 Mach-O 应用程序二进制文件、库、框架、捆绑包及 dyld 共享缓存中的映像生成 Objective-C 头文件。它支持提取单个类，也能递归处理兼容文件。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-11-06"},{"id":"view8","name":"View8","name_zh":"View8 V8 字节码反编译器","url":"https://github.com/suleram/View8","evidence_url":"https://github.com/suleram/View8/blob/531ec8e52b6386a07f64b7aa1f3d897dd0d7f239/README.md","description_en":"View8 is a static analysis tool that decompiles serialized V8 bytecode (JSC) files into readable JavaScript-like text. It can also export opcodes, parsed objects, and function trees organized by declarations, calls, or references.","description_zh":"View8 是一款静态分析工具，可将序列化的 V8 字节码（JSC）文件反编译为便于阅读的类 JavaScript 文本。它还可导出操作码、解析后的对象，以及按声明、调用或引用关系组织的函数树。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"unwebpack-sourcemap","name":"unwebpack-sourcemap","name_zh":"unwebpack-sourcemap 源码恢复脚本","url":"https://github.com/rarecoil/unwebpack-sourcemap","evidence_url":"https://github.com/rarecoil/unwebpack-sourcemap/blob/83c33a4c2f50612564138724e2f493a669886ad9/README.md","description_en":"unwebpack-sourcemap is a Python script that recovers TypeScript, JSX, and other source files from Webpack source maps. It accepts local or remote source maps and can search a web page's scripts for them.","description_zh":"unwebpack-sourcemap 是一个 Python 脚本，可从 Webpack 源映射中恢复 TypeScript、JSX 等源文件。它可处理本地或远程源映射，也可检查网页脚本以查找源映射。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-11-06"},{"id":"wirebrowser","name":"Wirebrowser","name_zh":"Wirebrowser 浏览器运行时插桩工具","url":"https://github.com/fcavallarin/wirebrowser","evidence_url":"https://github.com/fcavallarin/wirebrowser/blob/77e1e48ceb4acaef0356877ee2d09391763613cc/README.md","description_en":"Wirebrowser is a desktop tool for instrumenting browser JavaScript through the Chrome DevTools Protocol. It can hook functions, trace where values originate, search and modify runtime objects, and intercept or replay HTTP traffic.","description_zh":"Wirebrowser 是一款通过 Chrome DevTools Protocol 对浏览器 JavaScript 进行运行时插桩的桌面工具。它可以挂钩函数、追踪值的来源、查找和修改运行时对象，以及拦截或重放 HTTP 流量。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-11-06"},{"id":"process-dump","name":"Process Dump","name_zh":"Process Dump 进程内存转储工具","url":"https://github.com/glmcdona/Process-Dump","evidence_url":"https://github.com/glmcdona/Process-Dump/blob/e4373c687937747bf2293dd55ca09082fe4913c1/README.md","description_en":"Process Dump is a Windows command-line tool that saves code from running processes to disk for malware analysis. It can find hidden modules and loose executable code, reconstruct PE headers and imports, and use a clean-hash database to skip known modules.","description_zh":"Process Dump 是一款 Windows 命令行工具，可将运行中进程的代码保存到磁盘，供恶意软件分析使用。它能查找隐藏模块和独立的可执行代码，重建 PE 文件头与导入表，并通过已知文件的哈希数据库跳过常见模块。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"mal-unpack","name":"mal_unpack","name_zh":"mal_unpack 动态脱壳工具","url":"https://github.com/hasherezade/mal_unpack","evidence_url":"https://github.com/hasherezade/mal_unpack/blob/cecb9eed03c63d651c5b47834b15bac8086cb2fb/README.md","description_en":"mal_unpack is a Windows dynamic unpacker based on PE-sieve. It runs a packed malware executable, waits for its payload to unpack, dumps the payload, and terminates the original process.","description_zh":"mal_unpack 是基于 PE-sieve 的 Windows 动态脱壳工具。它运行经过加壳的恶意软件，等待载荷解包后将其转储，并终止原始进程。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"unrpyc","name":"Unrpyc","name_zh":"Unrpyc Ren'Py 脚本反编译器","url":"https://github.com/CensoredUsername/unrpyc","evidence_url":"https://github.com/CensoredUsername/unrpyc/blob/3ae8334ed71a05535927dcc559663d3aca51215b/README.md","description_en":"Unrpyc is a tool that decompiles compiled Ren'Py game scripts into readable script files. It runs from the command line or through files placed in a game's directory; it does not extract RPA archives.","description_zh":"Unrpyc 是将已编译的 Ren'Py 游戏脚本反编译为可读脚本文件的工具。它可通过命令行运行，也可将相关文件放入游戏目录中运行；它不能提取 RPA 归档。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"bspsrc","name":"BSPSource","name_zh":"BSPSource Source 引擎地图反编译器","url":"https://github.com/ata4/bspsrc","evidence_url":"https://github.com/ata4/bspsrc/blob/eaac417f16d3a4d8ef55bb637ecd7bff28740209/README.md","description_en":"Java map decompiler that turns Source engine .bsp map files back into .vmf files that can be loaded in Hammer. It also has an integrated pakfile extractor.","description_zh":"Java 地图反编译器，可把 Source 引擎的 .bsp 地图文件还原为能在 Hammer 中加载的 .vmf 文件。它还集成了 pakfile 提取功能。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"oghidra","name":"OGhidra","name_zh":"OGhidra Ghidra 大模型分析集成","url":"https://github.com/llnl/OGhidra","evidence_url":"https://github.com/llnl/OGhidra/blob/4b91e3f17bc825bc0d41a437cd01fa25e1221d79/README.md","description_en":"OGhidra is an AI integration for analyzing binaries with Ghidra through natural language. It supports function analysis, automated renaming, malware pattern detection, and either an MCP or PyGhidra backend.","description_zh":"OGhidra 是一款将 AI 接入 Ghidra、通过自然语言分析二进制文件的集成工具。它支持函数分析、自动重命名、恶意软件模式检测，并可使用 MCP 或 PyGhidra 后端。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-11-06"},{"id":"aidapal","name":"aiDAPal","name_zh":"aiDAPal IDA Pro 本地模型插件","url":"https://github.com/atredispartners/aidapal","evidence_url":"https://github.com/atredispartners/aidapal/blob/7cc7c34fb79f5e4cc94837689989f75cc8900b1b/README.md","description_en":"aiDAPal is an IDA Pro plugin that uses a locally hosted language model trained for Hex-Rays pseudocode to assist with code analysis. It presents generated changes for acceptance before updating the pseudocode.","description_zh":"aiDAPal 是一款 IDA Pro 插件，使用针对 Hex-Rays 伪代码训练、在本地运行的语言模型辅助代码分析。用户可以先决定是否接受生成的修改，再更新伪代码。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-11-06"},{"id":"openlara","name":"OpenLara: Tomb Raider engine reimplementation","name_zh":"OpenLara《古墓丽影》开源引擎","url":"https://github.com/XProger/OpenLara","evidence_url":"https://github.com/XProger/OpenLara/blob/3b268ca4bf986c380f44a26ffd9218bf6d376249/README.md","description_en":"Open-source engine for classic Tomb Raider, with a WebGL build and a standalone release. Its format code defines object types for Tomb Raider 1 through 4.","description_zh":"经典《古墓丽影》的开源引擎，提供 WebGL 版本和独立版本。其格式代码定义了《古墓丽影》1 至 4 代的对象类型。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"thyme","name":"Thyme: Command & Conquer Generals: Zero Hour reimplementation","name_zh":"Thyme《将军》引擎重实现","url":"https://github.com/TheAssemblyArmada/Thyme","evidence_url":"https://github.com/TheAssemblyArmada/Thyme/blob/ccef1e11c1355c6db577a057c06e7d790f1a0333/README.md","description_en":"Thyme is an open source reimplementation of Command & Conquer Generals: Zero Hour. It rewrites the game from the ground up and uses the original binary for functions it has not yet replaced.","description_zh":"Thyme 是《命令与征服：将军之绝命时刻》的开源重实现。项目从底层重写游戏，并借助原版二进制文件提供尚未重写的功能。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"chariot","name":"Chariot: Age of Empires engine reimplementation","name_zh":"Chariot《帝国时代》引擎重实现","url":"https://github.com/ChariotEngine/Chariot","evidence_url":"https://github.com/ChariotEngine/Chariot/blob/26b98d09d9a4d139bd4636fec0a9f30dc85db1d0/README.md","description_en":"Chariot is an open-source effort to reimplement the engine of the original Age of Empires (1997). It aims to support ports and enhancements; the README describes it as a work in progress with asset-loading demonstrations, not a playable game.","description_zh":"Chariot 是一个开源项目，旨在重新实现初代《帝国时代》（1997）的游戏引擎。项目希望支持移植和功能改进；README 称其仍在开发中，当时只能展示游戏资源加载，尚不能游玩。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"opendiablo2","name":"OpenDiablo2: Diablo 2 engine reimplementation","name_zh":"OpenDiablo2 暗黑破坏神 2 引擎","url":"https://github.com/OpenDiablo2/OpenDiablo2","evidence_url":"https://github.com/OpenDiablo2/OpenDiablo2/blob/7f92c571bf04057a7fbdfb5d25a486f7d775e3c3/README.md","description_en":"OpenDiablo2 is a cross-platform ARPG engine written in Go that supports playing Diablo 2. The project is being split into a separate engine and toolset, called Abyss Engine, and a game project retaining the OpenDiablo2 name.","description_zh":"OpenDiablo2 是一个用 Go 编写的跨平台动作角色扮演游戏引擎，支持运行 Diablo 2。项目正在拆分为名为 Abyss Engine 的引擎与工具集，以及继续使用 OpenDiablo2 名称的游戏项目。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"black-magic-debug","name":"Black Magic Debug","name_zh":"Black Magic Debug 微控制器调试工具","url":"https://codeberg.org/blackmagic-debug/blackmagic","evidence_url":"https://github.com/blackmagic-debug/blackmagic/blob/ac8d0ba3f22047e5e961856e4e4ff7c9d78b9c67/README.md","description_en":"Black Magic Debug is a self-contained debugger for microcontrollers. It detects and configures connected targets without configuration files.","description_zh":"Black Magic Debug 是一套用于微控制器的独立调试工具。它无需配置文件，即可检测并配置已连接的目标设备。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"openocd","name":"OpenOCD","name_zh":"OpenOCD 片上调试工具","url":"https://github.com/openocd-org/openocd","evidence_url":"https://github.com/openocd-org/openocd/blob/9f2d8762b3a75b4d7b2155affcf3d8bb8eb8849a/README.md","description_en":"OpenOCD is a tool for programming and debugging embedded targets through hardware debug adapters. It supports flash programming, breakpoints, single stepping, and remote debugging through GDB.","description_zh":"OpenOCD 是通过硬件调试适配器对嵌入式目标进行编程和调试的工具。它支持闪存编程、断点、单步执行，以及通过 GDB 进行远程调试。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-11-06"},{"id":"logicanalyzer","name":"LogicAnalyzer","name_zh":"LogicAnalyzer 逻辑分析仪","url":"https://github.com/gusmanb/logicanalyzer","evidence_url":"https://github.com/gusmanb/logicanalyzer/blob/4e88df784e4879c1f180456a72d71910dd15faf1/README.md","description_en":"LogicAnalyzer is a hardware and software tool for capturing digital signals and decoding communication protocols. It supports triggered capture, multiple channels, and Sigrok protocol decoders.","description_zh":"LogicAnalyzer 是一套用于采集数字信号和解析通信协议的软硬件工具。它支持触发采集、多通道采集和 Sigrok 协议解码器。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"btlejuice","name":"BtleJuice","name_zh":"BtleJuice 框架","url":"https://github.com/DigitalSecurity/btlejuice","evidence_url":"https://github.com/DigitalSecurity/btlejuice/blob/981b2e3fcaeca3d0c8faf6d61b4efd8130984bf4/README.md","description_en":"BtleJuice is a framework for intercepting Bluetooth Low Energy GATT operations between devices. Its web interface displays intercepted operations and supports replay, data modification, and export.","description_zh":"BtleJuice 是用于拦截设备间蓝牙低功耗 GATT 操作的框架。其网页界面可显示截获的操作，并支持重放、修改数据和导出记录。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"neardrop","name":"NearDrop","name_zh":"NearDrop Nearby Share 协议实现","url":"https://github.com/grishka/NearDrop","evidence_url":"https://github.com/grishka/NearDrop/blob/add655c6c5a40b9ba03c0329b598f2817185f5a9/README.md","description_en":"macOS menu bar app that partially implements Nearby Share and Quick Share to exchange files and links with Android devices. Its protocol document describes the protocol as understood from Chromium sources and a decompiled Google Services Framework APK.","description_zh":"macOS 菜单栏应用，部分实现 Nearby Share 和 Quick Share，可与 Android 设备交换文件和链接。其协议文档根据 Chromium 源码和反编译的 Google Services Framework APK 描述该协议。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"x64dbg-mcp-setsuna","name":"x64dbg MCP Server Plugin","name_zh":"x64dbg MCP 服务器插件","url":"https://github.com/SetsunaYukiOvO/x64dbg-mcp","evidence_url":"https://github.com/SetsunaYukiOvO/x64dbg-mcp/blob/56fe2355c90126d3b1793eba60b5a4a4d3443d9a/README.md","description_en":"An MCP server plugin for x64dbg and x32dbg that lets external applications and AI agents control debugging through HTTP. It provides tools for execution, memory, registers, breakpoints, and disassembly, along with debugger context resources and workflow prompts.","description_zh":"x64dbg MCP Server Plugin 是适用于 x64dbg 和 x32dbg 的 MCP 服务器插件，使外部应用和 AI 智能体能够通过 HTTP 控制调试过程。它提供执行控制、内存、寄存器、断点和反汇编工具，以及调试器上下文资源和工作流程提示。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-11-06"},{"id":"jebmcp","name":"JEB-MCP","name_zh":"JEB-MCP JEB Pro 集成","url":"https://github.com/flankerhqd/jebmcp","evidence_url":"https://github.com/flankerhqd/jebmcp/blob/e2fdb96390cfe4b92b754a0895ee9a22f6ce959f/README.md","description_en":"JEB-MCP is an MCP server and JEB Pro script that lets MCP clients inspect and rename elements of Android apps in JEB. Its documented commands include reading decompiled code, examining classes and methods, and renaming them.","description_zh":"JEB-MCP 是由 MCP 服务器和 JEB Pro 脚本组成的集成工具，让 MCP 客户端在 JEB 中查看和重命名 Android 应用的内容。README 列出的命令包括读取反编译代码、检查类与方法，以及重命名。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app"],"verified_at":"2026-11-06"},{"id":"re-shell","name":"re-shell","name_zh":"re-shell 逆向工程环境","url":"https://github.com/schlarpc/re-shell","evidence_url":"https://github.com/schlarpc/re-shell/blob/fd9d8583d120d00874c38b6dc6d70565b41f8bb4/README.md","description_en":"re-shell is a Nix flake development environment that provides Claude Code with reverse engineering tools and workflows. Its skills select guidance for Windows binaries, Android packages, and web captures based on the files being analyzed.","description_zh":"re-shell 是一个基于 Nix flake 的开发环境，为 Claude Code 提供逆向工程工具和工作流程。它会根据待分析的文件，为 Windows 二进制文件、Android 安装包和网页流量记录启用相应指导。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["app","binary","protocol","website"],"verified_at":"2026-11-06"},{"id":"ghidra-rpc","name":"ghidra-rpc","name_zh":"ghidra-rpc Ghidra 命令行集成","url":"https://github.com/cellebrite-labs/ghidra-rpc","evidence_url":"https://github.com/cellebrite-labs/ghidra-rpc/blob/fa3866243dcfcbc876baa7b13ae0deac2c443cd8/README.md","description_en":"ghidra-rpc is a CLI integration that lets AI coding assistants use a persistent Ghidra session for binary analysis. It returns structured JSON for tasks such as decompilation, symbol annotation, type recovery, patching, and binary version comparison.","description_zh":"ghidra-rpc 是一个命令行集成工具，让 AI 编程助手通过持续运行的 Ghidra 会话分析二进制文件。它以结构化 JSON 返回反编译、符号标注、类型恢复、修补和二进制版本比较等操作的结果。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-11-06"},{"id":"bloaty","name":"Bloaty","name_zh":"Bloaty 二进制体积分析工具","url":"https://github.com/google/bloaty","evidence_url":"https://github.com/google/bloaty/blob/ccb49b0be3d5bc0dd156bcf16f1515726c395ec5/README.md","description_en":"Bloaty is a binary size profiler that attributes file and memory usage to sources such as symbols, compilation units, and sections. It can compare sizes between binaries and supports ELF and Mach-O, with experimental PE/COFF and WebAssembly support.","description_zh":"Bloaty 是一款二进制文件体积分析工具，可按符号、编译单元和节等来源统计文件大小与内存占用。它还能比较二进制文件的体积变化，支持 ELF 和 Mach-O，并以实验性方式支持 PE/COFF 和 WebAssembly。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"soot","name":"Soot","name_zh":"Soot Java 字节码分析框架","url":"https://github.com/soot-oss/soot","evidence_url":"https://github.com/soot-oss/soot/blob/0199d84f6c5a7a9e967581e67877c475518f2bb8/README.md","description_en":"Soot is a Java optimization framework for analyzing and transforming Java bytecode. It provides four intermediate representations, including forms suited to optimization, decompilation, and code inspection.","description_zh":"Soot 是用于分析和转换 Java 字节码的优化框架。它提供四种中间表示，可用于优化、反编译和代码检查。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-11-06"},{"id":"bingrep","name":"bingrep","name_zh":"bingrep 二进制查看工具","url":"https://github.com/m4b/bingrep","evidence_url":"https://github.com/m4b/bingrep/blob/99d10541c7d442c50f732e62c507f1d62001413e/README.md","description_en":"bingrep is a command-line tool for inspecting and colorizing binary files. It displays details from ELF, Mach, Unix and BSD archives, and PE files, with experimental views of hexadecimal data and file offset ranges.","description_zh":"bingrep 是用于查看二进制文件并以颜色区分其内容的命令行工具。它可显示 ELF、Mach、Unix 和 BSD 归档文件及 PE 文件的信息，并提供实验性的十六进制数据和文件偏移范围视图。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"libpeconv","name":"libPeConv","name_zh":"libPeConv PE 文件处理库","url":"https://github.com/hasherezade/libpeconv","evidence_url":"https://github.com/hasherezade/libpeconv/blob/0fc25f680e03699d33ef3b2034a6724365f3d1a4/README.md","description_en":"libPeConv is a Windows library for loading and manipulating PE files. It supports tasks such as section remapping, relocation, import loading, resource parsing, and rebuilding import address tables from memory dumps.","description_zh":"libPeConv 是用于加载和处理 PE 文件的 Windows 库。它支持节区重映射、重定位、导入项加载、资源解析，以及从内存转储中重建导入地址表。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"viper-framework","name":"Viper","name_zh":"Viper 二进制分析与样本管理框架","url":"https://github.com/viper-framework/viper","evidence_url":"https://github.com/viper-framework/viper/blob/fdd7855249340cdf114447822026ded66f17d6a3/README.md","description_en":"Viper is a framework for binary analysis and for organizing malware samples, exploit samples, and research scripts. The Viper 1.x repository is archived and development has ended.","description_zh":"Viper 是一个二进制分析框架，也用于整理恶意软件样本、漏洞利用样本和研究脚本。Viper 1.x 仓库已归档，开发已停止。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"droidlysis","name":"DroidLysis","name_zh":"DroidLysis 安卓应用预分析工具","url":"https://github.com/cryptax/droidlysis","evidence_url":"https://github.com/cryptax/droidlysis/blob/346c2b6350f70e2854f58d33dab477fe6a7edfd6/README.md","description_en":"DroidLysis is a pre-analysis tool for Android apps that disassembles samples, organizes their contents, and flags code patterns for further inspection. It accepts APK, DEX, ODEX, ARM executable, ZIP, RAR, and directory inputs.","description_zh":"DroidLysis 是一款安卓应用预分析工具，可反汇编样本、整理文件内容，并标出值得进一步查看的代码模式。它支持 APK、DEX、ODEX、ARM 可执行文件、ZIP、RAR 和目录输入。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-11-06"},{"id":"pkhex","name":"PKHeX","name_zh":"PKHeX 宝可梦存档编辑器","url":"https://github.com/kwsch/PKHeX","evidence_url":"https://github.com/kwsch/PKHeX/blob/0660d1e1f4924b8478daec73281bb8071a82ad19/README.md","description_en":"PKHeX is a C# Windows Forms editor for Pokémon core-series save data. It can edit and save supported files, import Pokémon and teams, and convert data between game generations.","description_zh":"PKHeX 是一款用 C# 编写的 Windows Forms 宝可梦系列游戏存档编辑器。它可以编辑并保存受支持的文件、导入宝可梦与队伍数据，并在不同游戏世代之间转换数据。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-11-06"},{"id":"thug","name":"Thug","name_zh":"Thug 低交互蜜罐客户端","url":"https://github.com/buffer/thug","evidence_url":"https://github.com/buffer/thug/blob/5122baa855a0f0803502e24c6ffe0b1ff9af8e29/README.rst","description_en":"Thug is a Python low-interaction honeyclient that mimics a web browser to detect and emulate malicious content. It supports the study of client-side attacks.","description_zh":"Thug 是一款用 Python 编写的低交互蜜罐客户端，通过模拟网页浏览器来检测和仿真恶意内容。它可用于研究针对客户端的攻击。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-11-06"},{"id":"cuckoo3","name":"Cuckoo3","name_zh":"Cuckoo3 恶意软件分析工具","url":"https://github.com/cert-ee/cuckoo3","evidence_url":"https://github.com/cert-ee/cuckoo3/blob/86be764b78d08979b15aa0b61f76ee7d67c4c17b/README.md","description_en":"Cuckoo3 is a malware analysis tool that tests suspicious files and links in sandboxed platform emulators. It reports what the files or websites did during the test.","description_zh":"Cuckoo3 是一款恶意软件分析工具，可在沙箱化的平台模拟器中检查可疑文件和链接。它会生成报告，记录文件或网站在检查过程中的行为。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary","website"],"verified_at":"2026-11-06"},{"id":"cuckoo-sandbox","name":"Cuckoo Sandbox","name_zh":"Cuckoo Sandbox 恶意软件分析沙箱","url":"https://github.com/cuckoosandbox/cuckoo","evidence_url":"https://github.com/cuckoosandbox/cuckoo/blob/50452a39ff7c3e0c4c94d114bc6317101633b958/README.rst","description_en":"Cuckoo Sandbox is an automated malware analysis system that executes suspicious files in an isolated environment and reports their behavior.","description_zh":"Cuckoo Sandbox 是自动化恶意软件分析系统，可在隔离环境中执行可疑文件并报告其行为。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"fq","name":"fq","name_zh":"fq 二进制格式分析工具","url":"https://github.com/wader/fq","evidence_url":"https://github.com/wader/fq/blob/3f518c8d01f608b3402aa8317314f100c41d6dd0/README.md","description_en":"fq is a command-line tool and query language for inspecting and decoding binary formats. It provides a structural hex viewer, bit-level decoding, nested format parsing, and an interactive query interface.","description_zh":"fq 是用于查看和解码二进制格式的命令行工具及查询语言。它提供结构化十六进制视图、位级解码、嵌套格式解析和交互式查询界面。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","protocol"],"verified_at":"2026-11-06"},{"id":"innoextract","name":"innoextract","name_zh":"innoextract Inno Setup 解包工具","url":"https://github.com/dscharrer/innoextract","evidence_url":"https://github.com/dscharrer/innoextract/blob/6e9e34ed0876014fdb46e684103ef8c3605e382e/README.md","description_en":"Unpacks Inno Setup installers on non-Windows systems without running them. It also handles modified variants, including GOG.com's Inno Setup-based game installers.","description_zh":"在非 Windows 系统上解包 Inno Setup 安装程序，无需运行它们。它也支持修改版安装包，包括 GOG.com 基于 Inno Setup 的游戏安装包。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"metasm","name":"Metasm","name_zh":"Metasm Ruby 汇编处理套件","url":"https://github.com/jjyg/metasm","evidence_url":"https://github.com/jjyg/metasm/blob/a70271c239ba15a496975ce23018eb263167ad2c/README","description_en":"Metasm is a Ruby suite for assembling, disassembling, debugging, and modifying executable binaries. It supports formats including PE, ELF, Mach-O, and shellcode.","description_zh":"Metasm 是一套用于汇编、反汇编、调试和修改可执行二进制文件的 Ruby 工具。它支持 PE、ELF、Mach-O 和 shellcode 等格式。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-11-06"},{"id":"opentomb","name":"OpenTomb: Tomb Raider engine reimplementation","name_zh":"OpenTomb：《古墓丽影》引擎重实现","url":"https://github.com/opentomb/OpenTomb","evidence_url":"https://github.com/opentomb/OpenTomb/blob/ae7e07af766a48c7e5b5f2d6e14a5fa64e37e20c/README.md","description_en":"OpenTomb is an open-source reimplementation of the classic Tomb Raider engine for playing levels from Tomb Raider 1–5 and custom TRLE levels. It is no longer maintained.","description_zh":"OpenTomb 是经典《古墓丽影》引擎的开源重新实现项目，可运行《古墓丽影》1–5 及自制 TRLE 关卡。该项目已停止维护。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"savagewindrecomp","name":"Savage Wind Recomp: statically recompiling The Legend of Zelda: Breath of the Wild","name_zh":"Savage Wind Recomp：《塞尔达传说：旷野之息》静态重编译","url":"https://github.com/Revivedx/SavageWindRecomp","evidence_url":"https://github.com/Revivedx/SavageWindRecomp/blob/bf6146c14c37fee8781a601e5a544b93dff6d75e/README.md","description_en":"Savage Wind Recomp is an in-progress static recompilation of the Nintendo Switch version of The Legend of Zelda: Breath of the Wild for Windows and Linux. It builds native game code locally from the player's extracted files; the README reports playable early areas but says the full story remains unconfirmed.","description_zh":"Savage Wind Recomp 是一个仍在开发中的静态重编译项目，旨在让 Nintendo Switch 版《塞尔达传说：旷野之息》在 Windows 和 Linux 上以原生程序运行。它在本地根据玩家自行提取的游戏文件构建代码；README 称前期区域可以游玩，但尚未确认主线全程可通关。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"retruxx","name":"retruxx: reverse-engineered Hard Truck Apocalypse","name_zh":"retruxx：《Hard Truck Apocalypse》逆向工程","url":"https://github.com/mindflower/retruxx","evidence_url":"https://github.com/mindflower/retruxx/blob/e94ac261e4a4a4783b092ff4aba02ec2c2121f04/README.md","description_en":"retruxx is a reverse-engineered Hard Truck Apocalypse project that builds the game executable and separate renderer, input, and sound DLLs. Its 32-bit build matches the original game's memory layouts.","description_zh":"retruxx 是《Hard Truck Apocalypse》的逆向工程项目，可构建游戏可执行文件以及独立的渲染、输入和声音 DLL。其 32 位构建与原游戏的内存布局一致。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-11-06"},{"id":"nxnative","name":"nxnative","name_zh":"nxnative Switch 游戏原生打包工具","url":"https://github.com/seedds/nxnative","evidence_url":"https://github.com/seedds/nxnative/blob/88c7e03f51e3934dc227089ea81ec64fcd525b03/README.md","description_en":"nxnative is a tool that packages Nintendo Switch games as apps that run their code natively on Apple hardware, with graphics translated to Metal. It builds iPhone, iPad, or Mac apps from supported Switch games; Switch 2 builds are documented for Mac only.","description_zh":"nxnative 是一款将 Nintendo Switch 游戏打包为 Apple 设备应用的工具，让游戏代码在设备上原生运行，并将图形处理转换为 Metal。它可为受支持的 Switch 游戏生成 iPhone、iPad 或 Mac 应用；Switch 2 游戏目前仅说明了 Mac 构建方式。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-11-06"},{"id":"impacket","name":"Impacket","name_zh":"Impacket 网络协议库","url":"https://github.com/fortra/impacket","evidence_url":"https://github.com/fortra/impacket/blob/0b3ef2b979ba0f52dfc852dd41e0f90ce7b3bc42/README.md","description_en":"Impacket is a Python library for constructing and parsing network packets and working with protocol implementations. It covers protocols including SMB and MSRPC and includes example tools.","description_zh":"Impacket 是用于构造、解析网络数据包及使用协议实现的 Python 库。它涵盖 SMB、MSRPC 等协议，并附带示例工具。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-11-06"},{"id":"r0idamcp","name":"r0idamcp","name_zh":"r0idamcp（IDA Pro MCP 服务器）","url":"https://github.com/r0ysue/r0idamcp","evidence_url":"https://github.com/r0ysue/r0idamcp/blob/4b69484d58bbcd162e641af5b5189489ad5bcaf1/README.md","description_en":"r0idamcp is a single-file MCP server that connects IDA Pro to an MCP-capable assistant for automated reverse engineering. Its tools expose functions, strings, decompilation, cross-references, comments, and renaming through an SSE connection.","description_zh":"r0idamcp 是一个单文件 MCP 服务器，可将 IDA Pro 连接到支持 MCP 的助手，用于自动化逆向分析。它通过 SSE 连接提供函数和字符串查询、反编译、交叉引用、注释及重命名等功能。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-11-06"},{"id":"somcp","name":"SOMCP","name_zh":"SOMCP Android 原生库 MCP 服务器","url":"https://github.com/bilieebiliee1-design/SOMCP","evidence_url":"https://github.com/bilieebiliee1-design/SOMCP/blob/62a758357dbc484660f56dbe4c785f230311673f/README.md","description_en":"SOMCP is an Android MCP server for analyzing and modifying native SO libraries. It exposes ELF analysis, disassembly, patching, and optional dynamic analysis tools to MCP clients.","description_zh":"SOMCP 是在 Android 设备上分析和修改原生 SO 库的 MCP 服务器。它向 MCP 客户端提供 ELF 分析、反汇编、补丁以及可选的动态分析工具。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app","binary"],"verified_at":"2026-11-06"},{"id":"virtualxposed","name":"VirtualXposed","name_zh":"VirtualXposed 免 Root Xposed 环境","url":"https://github.com/android-hacker/VirtualXposed","evidence_url":"https://github.com/android-hacker/VirtualXposed/blob/122beb371519cb2d221ce06756361aaa30e2674f/README.md","description_en":"VirtualXposed is an Android app that runs Xposed modules alongside apps in a virtual environment without root access, an unlocked bootloader, or a custom system image. It is based on VirtualApp and epic.","description_zh":"VirtualXposed 是一款 Android 应用，可在虚拟环境中让 Xposed 模块作用于应用，无需 Root、解锁引导程序或刷入自定义系统镜像。它基于 VirtualApp 和 epic。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"edxposed","name":"EdXposed Framework","name_zh":"EdXposed 框架","url":"https://github.com/ElderDrivers/EdXposed","evidence_url":"https://github.com/ElderDrivers/EdXposed/blob/8f2308cdde0a8151a2b4b0151c58b203154a8c6f/README.md","description_en":"EdXposed is a Riru module that provides an Xposed-compatible ART hooking framework for Android 8.0 through 11. It lets Xposed modules change system and app behavior without modifying APKs.","description_zh":"EdXposed 是一个 Riru 模块，为 Android 8.0 至 11 提供兼容 Xposed 的 ART Hook 框架。它让 Xposed 模块无需修改 APK 即可改变系统和应用的行为。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"vector-lsposed","name":"Vector Framework","name_zh":"Vector 框架","url":"https://github.com/JingMatrix/Vector","evidence_url":"https://github.com/JingMatrix/Vector/blob/093ea599bfa2b50c156da0af53e2e53576e88434/README.md","description_en":"Vector Framework is a Zygisk module that provides ART hooking for Android apps. It supports Xposed APIs and lets modules change app and system behavior in memory without modifying APK files.","description_zh":"Vector Framework 是为 Android 应用提供 ART Hook 功能的 Zygisk 模块。它支持 Xposed API，让模块在内存中改变应用和系统的行为，无需修改 APK 文件。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"justtrustme","name":"JustTrustMe","name_zh":"JustTrustMe 证书校验绕过模块","url":"https://github.com/Fuzion24/JustTrustMe","evidence_url":"https://github.com/Fuzion24/JustTrustMe/blob/35efd07e93ad1e5633454fbc72dbf4b00c622932/Readme.md","description_en":"JustTrustMe is an Xposed module that disables SSL certificate checks in Android apps. It can help expose network traffic from apps that use certificate pinning.","description_zh":"JustTrustMe 是一个用于关闭 Android 应用 SSL 证书检查的 Xposed 模块。它可帮助查看采用证书固定机制的应用的网络流量。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-11-06"},{"id":"spy-debugger","name":"spy-debugger","name_zh":"spy-debugger 移动页面调试代理","url":"https://github.com/wuchangming/spy-debugger","evidence_url":"https://github.com/wuchangming/spy-debugger/blob/03d787151159c96229aff0266e0d3038af1e69a3/README.md","description_en":"spy-debugger is a tool for remotely debugging pages in mobile browsers and app WebViews while capturing HTTP and HTTPS traffic. It injects weinre debugging code into HTML responses and can use its built-in proxy or an external one.","description_zh":"spy-debugger 是一款远程调试手机浏览器和应用 WebView 页面、抓取 HTTP 与 HTTPS 流量的工具。它会在 HTML 响应中注入 weinre 调试代码，并可使用内置代理或外部代理。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["app","website"],"verified_at":"2026-11-06"}]}